U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

92–654 PDF 2004

WORM AND VIRUS DEFENSE: HOW CAN WE PROTECT THE NATION’S COMPUTERS FROM THESE

THREATS?

HEARING

BEFORE THE

SUBCOMMITTEE ON TECHNOLOGY, INFORMATION

POLICY, INTERGOVERNMENTAL RELATIONS AND

THE CENSUS

OF THE

COMMITTEE ON

GOVERNMENT REFORM

HOUSE OF REPRESENTATIVES

ONE HUNDRED EIGHTH CONGRESS

FIRST SESSION

SEPTEMBER 10, 2003

Serial No. 108–123

Printed for the use of the Committee on Government Reform

(

Available via the World Wide Web: http://www.gpo.gov/congress/house

http://www.house.gov/reform

(II)

COMMITTEE ON GOVERNMENT REFORM

TOM DAVIS, Virginia, Chairman

DAN BURTON, Indiana

CHRISTOPHER SHAYS, Connecticut

ILEANA ROS-LEHTINEN, Florida

JOHN M. MCHUGH, New York

JOHN L. MICA, Florida

MARK E. SOUDER, Indiana

STEVEN C. LATOURETTE, Ohio

DOUG OSE, California

RON LEWIS, Kentucky

JO ANN DAVIS, Virginia

TODD RUSSELL PLATTS, Pennsylvania

CHRIS CANNON, Utah

ADAM H. PUTNAM, Florida

EDWARD L. SCHROCK, Virginia

JOHN J. DUNCAN, JR., Tennessee

JOHN SULLIVAN, Oklahoma

NATHAN DEAL, Georgia

CANDICE S. MILLER, Michigan

TIM MURPHY, Pennsylvania

MICHAEL R. TURNER, Ohio

JOHN R. CARTER, Texas

WILLIAM J. JANKLOW, South Dakota

MARSHA BLACKBURN, Tennessee

HENRY A. WAXMAN, California

TOM LANTOS, California

MAJOR R. OWENS, New York

EDOLPHUS TOWNS, New York

PAUL E. KANJORSKI, Pennsylvania

CAROLYN B. MALONEY, New York

ELIJAH E. CUMMINGS, Maryland

DENNIS J. KUCINICH, Ohio

DANNY K. DAVIS, Illinois

JOHN F. TIERNEY, Massachusetts

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

CHRIS VAN HOLLEN, Maryland

LINDA T. SANCHEZ, California

C.A. ‘‘DUTCH’’ RUPPERSBERGER, Maryland

ELEANOR HOLMES NORTON, District of

Columbia

JIM COOPER, Tennessee

CHRIS BELL, Texas

———

BERNARD SANDERS, Vermont

(Independent)

PETER SIRH, Staff Director

MELISSA WOJCIAK, Deputy Staff Director

ROB BORDEN, Parliamentarian

TERESA AUSTIN, Chief Clerk

PHILIP M. SCHILIRO, Minority Staff Director

SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL

RELATIONS AND THE CENSUS

ADAM H. PUTNAM, Florida, Chairman

CANDICE S. MILLER, Michigan

DOUG OSE, California

TIM MURPHY, Pennsylvania

MICHAEL R. TURNER, Ohio

WM. LACY CLAY, Missouri

DIANE E. WATSON, California

STEPHEN F. LYNCH, Massachusetts

EX OFFICIO

TOM DAVIS, Virginia HENRY A. WAXMAN, California

BOB DIX, Staff Director

CHIP WALKER, Professional Staff Member

URSULA WOJCIECHOWSKI, Clerk

DAVID MCMILLEN, Minority Professional Staff Member

(III)

C O N T E N T S

Page

Hearing held on September 10, 2003 ..................................................................... 1

Statement of:

Akers, Greg, senior vice president, chief technology officer, government

solutions and corporate security programs, Cisco Systems, Inc.; Phil

Reitinger, senior security strategist, Microsoft Corp.; Vincent Gullotto,

vice president, antivirus emergency response team, Network Associates,

Inc.; and John Schwarz, president and chief operating officer, Symantec

Corp. ............................................................................................................... 125

Dacey, Robert, Director, IT Security, General Accounting Office; Richard

Pethia, Director, Cert Coordination Center; Lawrence Hale, Director,

FedCIRC, Department of Homeland Security; Norman Lorentz, Acting

Administrator, Electronic Government and Information Technology, Office of Management and Budget; and John Malcolm, Deputy Assistant

Attorney General, Criminal Division, Department of Justice ................... 7

Eschelbeck, Gerhard, chief technology officer and vice president of engineering, Qualys, Inc.; Christopher Wysopal, co-founder, Organization

for Internet Safety and director of research and development,

@stake.Inc.; and Ken Silva, vice president, operations and infrastructure, Verisign, Inc. ........................................................................................ 87

Letters, statements, etc., submitted for the record by:

Akers, Greg, senior vice president, chief technology officer, government

solutions and corporate security programs, Cisco Systems, Inc., prepared statement of ........................................................................................ 128

Clay, Hon. Wm. Lacy, a Representative in Congress from the State of

Missouri, prepared statement of .................................................................. 71

Dacey, Robert, Director, IT Security, General Accounting Office, prepared

statement of ................................................................................................... 9

Eschelbeck, Gerhard, chief technology officer and vice president of engineering, Qualys, Inc., prepared statement of ............................................. 89

Gullotto, Vincent, vice president, antivirus emergency response team,

Network Associates, Inc., prepared statement of ....................................... 157

Hale, Lawrence, Director, FedCIRC, Department of Homeland Security,

prepared statement of ................................................................................... 46

Lorentz, Norman, Acting Administrator, Electronic Government and Information Technology, Office of Management and Budget, prepared

statement of ................................................................................................... 52

Malcolm, John, Deputy Assistant Attorney General, Criminal Division,

Department of Justice, prepared statement of ........................................... 58

Pethia, Richard, Director, Cert Coordination Center, prepared statement

of ..................................................................................................................... 31

Putnam, Hon. Adam H., a Representative in Congress from the State

of Florida, prepared statement of ................................................................ 4

Reitinger, Phil, senior security strategist, Microsoft Corp., prepared statement of ........................................................................................................... 142

Schwarz, John, president and chief operating officer, Symantec Corp.,

prepared statement of ................................................................................... 175

Silva, Ken, vice president, operations and infrastructure, Verisign, Inc.,

prepared statement of ................................................................................... 110

Wysopal, Christopher, co-founder, Organization for Internet Safety and

director of research and development, @stake.Inc., prepared statement

of ..................................................................................................................... 98

(1)

WORM AND VIRUS DEFENSE: HOW CAN WE

PROTECT THE NATION’S COMPUTERS FROM

THESE THREATS?

WEDNESDAY, SEPTEMBER 10, 2003

HOUSE OF REPRESENTATIVES,

SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY,

INTERGOVERNMENTAL RELATIONS AND THE CENSUS,

COMMITTEE ON GOVERNMENT REFORM,

Washington, DC.

The subcommittee met, pursuant to notice, at 10 a.m., in room

2154, Rayburn House Office Building, Hon. Adam Putnam (chairman of the subcommittee) presiding.

Present: Representatives Putnam, Miller, and Clay.

Staff present: Bob Dix, staff director; John Hambel, senior counsel; Chip Walker, Scott Klein, and Lori Martin, professional staff

members; Ursula Wojciechowski, clerk; Suzanne Lightman, fellow;

Jamie Harper and Erik Glavich, legislative assistants; David

McMillen, minority professional staff member; and Jean Gosa, minority assistant clerk.

Mr. PUTNAM. The quorum being present, the Subcommittee on

Technology, Information Policy, Intergovernmental Relations and

the Census will come to order. Good morning.

Today we continue our in-depth review of cyber security issues

affecting our Nation. There are several things unique to cyber attacks that make the task of preventing them difficult. Cyber attacks can occur from anywhere around the globe, from the caves of

Afghanistan to the battlefields of Iraq, from the most remote regions in the world or right here in our own back yard. The technology used for cyber attacks is readily available and changes continually, and perhaps most dangerous of all is the failure of many

people, including those who are critical to securing these networks

and information from attack, to take the threat seriously, to receive

adequate training and take proactive steps needed to secure their

networks. A severe cyber attack would have devastating repercussions throughout the Nation in a physical sense and in real economic dollars.

The initial plan for this hearing was to focus primarily on strategies and methodologies within the agencies of the Federal Government for identifying and mitigating computer vulnerabilities

through a system of patch management. Recent events, however,

have caused us to expand the boundaries of this hearing to include

computer systems throughout the Nation.

2

This summer, everyone once again realized how vulnerable our

computer networks are to cyber attack. The Blaster worm and

SoBig.F virus brought home the reality that unsecured computer

systems are all too prevalent and that as a Nation across all levels,

government, business and home users, we must take computer security more seriously than we have in the past. The Blaster worm

infected over 400,000 computers in under 5 days. In fact, 1 in 3

Internet users are infected with some type of virus or worm every

year.

The speed at which worms and viruses can spread is astonishing

and a contributing fact to that rapid spread is the lethargic pace

at which people deploy the patches that can prevent infection in

the first place. Microsoft announced the vulnerability and had the

patch available weeks before the exploit appeared.

Recent viruses and worms have been blamed for bringing down

train signaling stations throughout the East, affecting the entire

CSX railroad system, which covers 23 States. Additionally, new information is coming to light that the Blaster worm is being linked

to the severity of the power blackout of last month. The North

American Electric Reliability Council blames another worm,

Slammer, for impairing bulk electric system control by bringing

down networks. We learned last week that the U.S. Nuclear Regulatory Commission issued a formal information notice to nuclear

power plant operators warning them about an incident in January

in which the Slammer computer worm penetrated networks in

Ohio’s Davis-Besse nuclear plant and disabled two important monitoring systems for hours.

A recent Gartner study predicts that by the year 2005, 90 percent of cyber attacks will attempt to exploit vulnerabilities for

which a patch is already available or a solution known. So why

aren’t systems patched and why aren’t anti-virus programs kept up

to date? This hearing will examine the issues surrounding these incidents, including how vulnerabilities are discovered, how the public is notified about potential vulnerabilities, the mechanisms for

protection, the real and potential problems presented by patch systems and the scope of the problem confronting the Federal Government, the business community, and the general public.

System administrators are often overwhelmed with simply maintaining all the systems they have responsibility for overseeing.

Challenges that organizations face in maintaining their systems

are significant. With an estimated 4,000 vulnerabilities being discovered every year, it is an enormous challenge for any but the best

resourced organizations to install all of the software patches that

are released by the manufacturer. Not only is the sheer quantity

of patches overwhelming for administrators and everyone else to

keep up with, but patches can be difficult to apply and have unexpected side effects on other systems that administrators must then

evaluate and address. As a result, after a patch is released, administrators often take a long time to fix all of their vulnerable computer systems. Obviously small organizations and home users who

lack the skills of system administrators are even less likely to keep

up with the flow of patches.

The Department of Homeland Security’s Federal Computer Incident Response Center recently let a $10.8 million 5-year contract

3

for governmentwide patch management service to notify agencies

about security holes in commercial software for systems on their

networks and the availability of patches to fix them. The service

is known as the patch authentication and dissemination capability

[PADC]. The goal is to simplify patch management by providing administrators only with information relevant to their systems and

ensuring that patches are genuine and affected. PADC went on-line

in January of this year. According to officials, once agency system

administrators have provided a profile of their systems and software, PADC will alert them to potential vulnerabilities, provide interim security advice until a patch is available, disseminate available patches and keep management informed of available patches

and which ones their systems administrators have downloaded.

Large organizations such as business and educational institutions often rely on commercial firms to notify them of

vulnerabilities. For example, there are several firms that offer vulnerability notification combined with analysis of the customer’s

computer system for those vulnerabilities. These firms also provide

information on where to get the patches and prioritize them for administrators. In addition, the commercial critical infrastructure

sectors depend on information from their information sharing analysis centers [ISACs], to help them respond to potential cyber

threats. These ISACs are designed to allow members of a sector to

share information about incidents to help increase preparedness

and vigilance. The progress of Blaster demonstrates the importance

of the early warning systems that ISACs are tasked with developing.

Independent researchers discover most vulnerabilities. These researchers may be academics, consultants or Black Hats. The Organization for Internet Security is working with software vendors,

consultants and other interested parties to formalize procedures for

dealing with vulnerabilities, including vendor notification and control disclosures. There’s a very important role for government to

play in these disclosure procedures. It is no longer acceptable for

vendors to determine on their own schedule who gets notified and

when. Given the potential national security risk that can emanate

from the exploitation of a vulnerability, it is imperative that the

appropriate government entities be involved in this process from

the beginning.

Vulnerabilities in software and the worms and viruses that exploit them have become a fact of life for the Internet. The government, law enforcement and private industry must develop and continue to update a plan to deal with these emerging threats.

How can we educate home and small business users to minimize

the risk posed by zombie computers? How can researchers, the government and software industry work together to identify and remedy vulnerabilities in the most instructive manner? And how will

the Federal Government evolve an effective patch management

program? What can be done to expedite the discovery and prosecution of cyber criminals who release worms and viruses? And most

important of all, how can the Federal Government, law enforcement and industry work together to protect the vital infrastructure

of the Internet?

[The prepared statement of Hon. Adam H. Putnam follows:]

4

5

6

7

Mr. PUTNAM. We have an outstanding line up of witnesses this

morning who will share with us their expertise as we explore

worms and viruses and how we can better protect the Nation’s

computers. As is the custom of this committee, we’ll ask our witnesses as they are seated in panel one to rise and be sworn in.

[Witnesses sworn.]

Mr. PUTNAM. Note for the record that all of the witnesses responded in the affirmative. We will begin with our first witness,

and we have three panels. The panels are rather large panels. They

are unusually large for this subcommittee, but the scope of our

topic demanded it. But we would ask that all of our witnesses adhere as best they can to our 5-minute rule. And I will introduce Mr.

Dacey.

Robert Dacey is currently Director of Information, Security

Issues at the U.S. General Accounting Office. His responsibilities

include evaluating information systems security in Federal agencies and corporations, including the development of related methodologies, assessing the Federal infrastructure for managing information security, evaluating the Federal Government’s efforts to

protect our Nation’s private and public critical infrastructure from

cyber threats and identifying best security practices at leading organizations and promoting their adoption by Federal agencies. In

addition to his many years at information security auditing, Mr.

Dacey has also led GAO’s annual audits of the consolidated financial statements of the U.S. Government, GAO’S financial audit

quality assurance efforts, including methodology and training and

other GAO financial statement audits. We appreciate you being a

part of this panel, and you are recognized for 5 minutes.

STATEMENTS OF ROBERT DACEY, DIRECTOR, IT SECURITY,

GENERAL ACCOUNTING OFFICE; RICHARD PETHIA, DIRECTOR, CERT COORDINATION CENTER; LAWRENCE HALE, DIRECTOR, FEDCIRC, DEPARTMENT OF HOMELAND SECURITY;

NORMAN LORENTZ, ACTING ADMINISTRATOR, ELECTRONIC

GOVERNMENT AND INFORMATION TECHNOLOGY, OFFICE

OF MANAGEMENT AND BUDGET; AND JOHN MALCOLM, DEPUTY ASSISTANT ATTORNEY GENERAL, CRIMINAL DIVISION,

DEPARTMENT OF JUSTICE

Mr. DACEY. Thank you, Mr. Chairman. I am pleased to be here

today to participate in the subcommittee’s hearing on cyber incidents and the role of software patch management in mitigating the

risks that these types of events will recur. I will briefly summarize

my written statement.

The exploitation of software vulnerabilities by hackers and others can result in significant damage to both Federal and private

sector computer systems, ranging from Web site defacements to

gaining the ability to read, modify or delete sensitive information,

destroy systems, disrupt operations or launch attacks against other

organizations. The number of reported security vulnerabilities and

software products has grown dramatically in recent years to over

11,000 cumulatively reported by CERT/CC since 1995.

Factors increasing the risk of system vulnerabilities and exploits

include the increasing complexity and size of software programs,

the increasing sophistication and availability of hacking tools, inVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
8

creasing system interconnectivity combined with decreasing length

of time from the announcement of a vulnerability until it is exploited, and decreasing length of time for attacks to infiltrate the

Internet.

Although generally available before vulnerability exploits are

launched, patches are too frequently not installed, resulting in

damages to unpatched systems. My written testimony refers to several of these exploits and summarizes the responses to two recently

reported serious vulnerabilities.

Given these increasing risks, effective patch management programs have become critical to securing both Federal and private

sector systems. Key elements of a patch management program include top management support, standardized policies, procedures

and tools; dedicated resources and clearly assigned responsibilities;

current technology inventories; identification of relevant

vulnerabilities and patches; patch risk assessment and testing;

patch distribution; and monitoring system through networks and

host vulnerability scanning.

There are several efforts to address software vulnerability in the

Federal systems, including OMB reporting requirements concerning agency patch management programs as part of the Federal Information Security Management Act [FISMA]; NIST, patch management guidance, and FedCIRC incident reporting, handling and

prevention handling services. For example, as you mentioned in

your statement, FedCIRC provides PADC, a patch notification service, which provides agencies at no charge with information on

trusted authenticated patches for their specific technologies. PADC

currently has 41 agency subscribers, although OMB recently reported that actual usage of those accounts are extremely low.

A number of commercial tools and resources are available that

can assist in performing patch management functions more efficiently and effectively, such as identifying relevant patches, deploying patches, scanning systems for vulnerabilities and providing

management reporting. In addition to implementing effective patch

management processes, several other steps can be taken to address

software vulnerabilities. These include one, deploying other technologies such as antivirus software, firewalls and other network security and configuration tools to provide a layered defense against

attacks; two, employing more rigorous software engineering practices in designing, implementing and testing software products to

reduce the number of potential vulnerabilities; three, improving

tools to more efficiently and effectively manage patching; four, researching and developing technologies to prevent, detect and recover from attacks as well as identify perpetrators; and five, ensuring effective tested contingency planning processes and procedures.

Mr. Chairman, this concludes my statement. I will be pleased to

answer any questions that you have at this time.

[The prepared statement of Mr. Dacey follows:]

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

Mr. PUTNAM. Thank you very much, Mr. Dacey. I appreciate you

adhering to our 5-minute rule as well.

Our next witness is Richard Pethia. Mr. Pethia directs the CERT

Coordination Center, which conducts security incident response activities and fosters the development of incident response infrastructures that leads to rapid correction of vulnerabilities and resolution

of incidents. Working out of the software engineering institute at

Carnegie Mellon University, he has been tracking vulnerabilities

for 15 years. Before coming to SEI, Mr. Pethia was the Director of

Engineering at the Decision Data Co. He has over 30 years experience in both technical and managerial positions.

You are recognized for 5 minutes, Mr. Pethia.

Mr. PETHIA. Thank you, Mr. Chairman, and thank you especially

for the opportunity to testify on the issue of defending against

cyber viruses and worms. At the CERT Coordination Center since

1988, we have handled over 260,000 security incidents and have

helped to resolve over 11,000 vulnerabilities, published hundreds of

security alerts and security best practice guides and provide training in a variety of security topics.

Worms and viruses are both in a more general category of programs called malicious code. Both exploit weaknesses in computer

software, replicating themselves and are attaching themselves to

other programs. They spread quickly. By definition, worms are programs that spread without human intervention once they have

been introduced into the system. And viruses are programs that require some action on the part of the user, such as opening an email attachment. Today these worms and viruses are causing damage more quickly than those created in the past and are spreading

to the most vulnerable of all systems, computer systems of home

users.

The Code Red worm spread around the world faster in 2001 than

the Melissa virus did in 1999. Just months later, the NIMDA worm

caused serious damage within an hour of the first reported infection. And in January of this year Slammer had significant impact

in just minutes. Virus and worm attacks alone have resulted in

millions of dollars of loss in just the last 12 months. The 2003 computer crime survey states that viruses are the most cited form of

attack with an estimated cost of over $27 million across the approximately 500 respondents to the survey. Estimates on the Blaster worm and the SoBig.F virus range from $525 million to more

than $1 billion in loss. The cost estimates include lost productivity,

wasted hours, lost sales and extra bandwidth cost.

For the past 15 years we have relied heavily on fast reaction to

ensure the damage is minimized. But today it’s clear that reactive

solutions alone are no longer adequate. Many attacks are now fully

automated and spread with blinding speed. The attack technology

has become increasingly complex, increasing the time it takes to

analyze the attack and produce countermeasures. We have been increasingly dependent on the Internet. Even short interruptions in

service cause significant loss and can jeopardize critical service.

Aggressive, coordinated, continually improving response will continue to be necessary, but we also must move quickly to put other

solutions in place. System operators must adopt security practices

such as information security risk assessments, security manageVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00033 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
30

ment policies and secure system administrations practices. Senior

managers must provide visible endorsement and financial support

for these security improvement efforts. They must also keep their

skills and knowledge current and educate their users to raise

awareness of security issues and improve their ability to recognize

and respond to problems. Technology vendors must also take steps

such as producing virus resistant or virus proof software, dramatically reducing the number of implementation errors in their products that lead to vulnerabilities, and providing secure out of the

box configurations that have security options turned on rather than

require users to enable the functions.

The government can also help by taking a multi-pronged approach: Using its buying power to demand higher quality software,

holding vendors more accountable for defects in released products

and providing incentives for low defect products and for products

that are highly resistant to viruses.

Information assurance research is also needed to yield networks

capable of surviving attacks while preserving sensitive information.

Among the activities should be the creation of a unified and integrated framework for all information assurance, rigorous methods

to assess and manage risk, quantitative techniques to determine

the cost benefit of risk mitigation strategies, systematic tools and

simulation tools to analyze cascade effects of attacks and new technologies for resisting, recognizing and recovering from attacks, accidents and failures.

More technical specialists should be trained to expand its scholarship programs to build the university infrastructure we will need

for the long-term development of trained security professionals.

And to encourage safe computing the government should support

the development of education material and programs about cyber

space for all users, including home users and small businesses,

support programs to provide early training and security practices

in appropriate use.

In conclusion, our dependence on interconnected computing systems is rapidly increasing and even short-term disruptions from viruses and worms have major consequences. Our current solutions

are not keeping pace with the increased strength and speed of attack and our information infrastructures are at risk.

The National Cyber Security Division formed by the Department

of Homeland Security is a critical step toward implementation of

some of these recommendations. However, implementing a safer

cyber space will require the NCSD and the entire Federal Government to work with State and local governments, the private sector

to drive better software practices, more secure products, higher

awareness at all levels, increase research and development activities and increase training for special computer users and all users.

Thank you.

[The prepared statement of Mr. Pethia follows:]

31

32

33

34

35

36

37

38

39

40

41

42

43

44

Mr. PUTNAM. Thank you very much. Our next witness is Mr.

Hale. Lawrence Hale is the Director of the Department of Homeland Security Federal Computer Incident Response Center

[FedCIRC]. He has been active in the information assurance community since 1996, when he served the chairman of the joint Chiefs

of Staff as an information assurance action officer working on security interoperability issues. While at the Pentagon Mr. Hale was a

member of the Joint Staff Information Operations Response Cell

during a number of exercises and actual cyber events, which have

helped to shape U.S. Government policy in dealing with computer

security.

In January 1999, Mr. Hale became the first uniformed military

officer assigned to the National Infrastructure Protection Center at

the FBI Headquarters. While there he worked to improve the process of issuing warnings of cyber related events and served on the

Y2K task force for the FBI. He retired from the U.S. Navy as a

commander in May 2001, has a Master’s Degree in national security and strategic studies from the Naval War College and a Master’s in aeronautical science from Embry-Riddle.

Welcome to the subcommittee.

Mr. HALE. Good morning, Mr. Chairman and Ranking Member

Clay. On behalf of the Federal Computer Incident Response Center

of the Department of Homeland Security, thank you for this opportunity to appear before you to discuss how we can protect the Nation’s computers. I am Lawrence Hale, Director of the FedCIRC,

which is part of the Department of Homeland Security’s Information Analysis and Infrastructure Protection Directorate. FedCIRC

is the Federal-civilian government’s trusted focal point for computer security incident reporting, providing assistance with incident prevention and response.

Within the Department of Homeland Security Information Analysis and Infrastructure Protection Directorate is the newly established National Cyber Security Division. The National Cyber Security Division is responsible for coordinating the implementation of

the national strategy to secure cyberspace. Key functional areas

within the division include Risk Threat and Vulnerability Identification and Reduction, Cyber Security Tracking, Analysis and Response Center and Outreach Awareness and Training. The

FedCIRC is now a component of Cyber Security Tracking, Analysis

and Response Center.

The National Cyber Security Division has combined the information gathering and analytical capabilities of the cyber watch elements of the National Infrastructure Protection Center and the

FedCIRC and coordinates with the National Communication System. By doing this, the National Cyber Security Division not only

has the added benefit of enhanced resources but the synergy of

knowledge created from the unique resources from each of these

watch elements.

The Federal Government’s ability to limit the effects of the recent wave of worms and viruses on its networks demonstrate how

these collaborative relationships work and how each participant’s

contributions help to assess and mitigate potential damage.

FedCIRC has the goal of securing the Federal Government’s cyberspace. FedCIRC, as noted in the e-Government Act of 2002, the

45

Federal Information Security Management Act, serves as the Federal information security incident center for the Federal civilian

government. FedCIRC is the central government non-law enforcement focal point for coordination of response to attacks, promoting

incident reporting and cross agency sharing of data about common

vulnerabilities. As such, FedCIRC must compile and analyze information about incidents that threaten information security and inform Federal agencies about current and potential information security threats and vulnerabilities.

FedCIRC demonstrated the National Cyber Security Division’s

enhanced coordination role during the recent wave of worms and

viruses. Working closely with the CERT Coordination Center and

software providers, FedCIRC identified the potential impact of

newly disclosed vulnerabilities and developed corrective actions in

mitigating strategies. Federal civilian agencies were advised of the

existence of these vulnerabilities and given actionable information

on reducing their exposure to the threats before attack programs

were released. Patches were developed, validated and disseminated

to agencies. And working closely with OMB and the Federal CIO

Council, agencies were instructed to take action to address the

vulnerabilities and report their status. As a result of these measures, the Federal Government was better prepared to avoid damaging impact when the exploit codes that were released in the attack

phase of these events occurred.

The National Cyber Security Division has a number of initiatives

underway to aid in threat vulnerability reduction. As was mentioned, the majority of successful attacks on computer systems result from hackers exploiting the most widely known vulnerabilities

in commercial software products. The problem is not that patches

to fix these vulnerabilities don’t exist, but that existing patches are

not quickly and correctly applied. Agencies must have a plan on

how patch management is integrated into their configuration management process. FedCIRC’s patch authentication and dissemination capability [PADC], a Web enabled service that provides a

trusted source of validated patches and notifications on new threat

and vulnerabilities, is a first step.

FedCIRC’s vision is to build from the ability of providing validated patches to developing a more enhanced IT configuration and

vulnerability management program that will automate the process.

By automating the process, agencies will no longer have the burden

of having to manually apply patches which will enable them to

have more time to focus on building a more robust configuration

management program.

In closing, I would like to assure the committee that the National

Cyber Security Division is committed to building on the success the

FedCIRC has achieved in helping Federal civilian agencies protect

their information systems from the most damaging effects of malicious code. National Cyber Security Division must now translate

this success to a national scale. I look forward to continuing to

work with OMB and the Congress to ensure that we are successful

in this important endeavor.

[The prepared statement of Mr. Hale follows:]

46

47

48

49

50

Mr. PUTNAM. Thank you very much Mr. Hale. I would like to

welcome our distinguished ranking member and vice chair of the

subcommittee as well, and we will be taking their opening statements at the conclusion of the first panel’s remarks as well.

Our next witness is Norman Lorentz. Mr. Lorentz joined the Office of Management and Budget in January 2002 as Chief Technology Officer, the Chief e-Government Architect for the Federal

Government. Mr. Lorentz is responsible for identifying and developing support for investments in emerging technology opportunities

that will improve the Government’s technical information and business architectures.

Prior to joining the Federal Government, he was senior vice

president and chief technology officer for the IT career solutions

provider, Dice, Inc. In this capacity he directed the development of

technology strategy and infrastructure. He was also the firm’s chief

quality officer and a member of the executive committee. He brings

to OMB extensive experience in government.

From 1998 to 2000, he was senior vice president and chief technology officer for the U.S. Postal Service. In 1998, he receive the

Board of Governors Award, the U.S. Postal Service’s highest recognition, and this year was named as a Federal 100 winner as well

as recognition by Info World magazine as 1 of the 25 most influential CTOs in the United States. And this is your last appearance

before a congressional committee as a public servant with OMB, as

you will be leaving that agency and moving back into the private

sector. So we appreciate your service to the government and to this

subcommittee, and you are recognized.

Mr. LORENTZ. Thank you, Mr. Chairman, and good morning,

members of the committee. Thank you for inviting me to discuss

this important topic of worm and virus defense. My testimony

today will address how the Federal Government protects its IT systems from this pervasive threat.

By design, worms and viruses can cause substantial damage and

prove disruptive to normal business operations. For this reason it

is important for the Federal agencies to continuously and rapidly

take proactive measures to lessen the number of successful attacks.

The month of August proved to be an unusually busy time for malicious code activity, beginning with Blaster and then quickly

spreading the SoBig.F worm. In general, the Federal Government

withstood these attacks and the impact on citizen services was

minimal.

Agencies have improved their protection against malicious code

by installing patches, blocking executables at the firewall and

using antivirus software with automatic updates. Agencies, however, did report modest impacts associated with both worms to

date. Reports from Federal civilian agencies show approximately

1,000 computers affected by each exploit. This impact ranged from

a slowdown in agency e-mail to temporary unavailability of agency

systems. A number of laptops proved to be susceptible to the infection since configuration management was even on these portable

devices.

The Federal Government’s ability to thwart worms and viruses

depends on a number of interlocking management, technical and

51

operational controls. It is critical that these controls continue to

evolve to keep pace with this increasingly sophisticated threat.

First, how were vulnerabilities discovered? DHS’s Federal Computer Incident Response Center [FedCIRC], closely coordinates

with a number of industry as well as government partners. These

partners include Carnegie Mellon CERT, law enforcement and the

Intelligence Community. These organizations routinely communicate advanced notice to DHS regarding the discovery of software

vulnerabilities in the development of malicious code.

Second, how are agencies notified about these vulnerabilities?

OMB and the CIO Council have developed and deployed a process

to rapidly identify and respond to cyber threats and critical

vulnerabilities. CIOs are advised via conference call as well as followup e-mail of specific actions necessary to protect agency systems. Agencies must then report through FedCIRC to OMB on the

implementation of those required countermeasures. This emergency

notification and reporting process was instituted for the Microsoft

RPC vulnerability in July and as a result the agencies were able

to rapidly close vulnerabilities that otherwise might have been exploited by the Blaster worm. There are mechanisms that exist for

protecting systems.

The National Institute of Standard and Technology [NIST], recommends that the agencies implement a patch management program, harden all hosts appropriately, deploy antivirus software and

detect and block malicious code and configure the network perimeter to deny all traffic that is not necessary. As part of the statutory responsibility under FISMA, the National Institute of Standards and Technology will publish in September draft guidelines for

incident handling. The guidelines will discuss how to establish and

maintain an effective incident reporting and response program with

an emphasis on incident detection, analysis, prioritization and containment. The guidelines will include recommendations for handling certain types of incidents and the distribution of denial of

service attacks and malicious code infections.

Last, the problems presented by the patching systems. Patch

management is an essential part of any agency’s information security program and requires a significant investment in time and effort. Agencies must carefully follow predefined processes in order to

successfully remediate system vulnerabilities across the enterprise.

A number of agencies utilize automated tools to push the patches

to the desktop. The automation of the patch management process

is significantly easier when the agency maintains a standardized

software configuration. At the present, 47 agencies subscribe to

FedCIRC’s PADC capability. This service validates and quickly distributes corrective patches for known vulnerabilities.

In closing, OMB is committed to a Federal Government with resilient information systems. Worms and viruses must not be able

or allowed to significantly affect agency business processes. OMB

will continue to work with the agencies, Congress and GAO to ensure that appropriate countermeasures are in place to reduce the

impact of malicious code.

Thank you very much.

[The prepared statement of Mr. Lorentz follows:]

52

53

54

55

56

Mr. PUTNAM. Thank you very much.

Our next witness is John Malcolm. Mr. Malcolm is currently a

Deputy Assistant Attorney General in the Criminal Division at the

Department of Justice, where his duties include overseeing the

Computer Crime and Intellectual Property Section, the Child Exploitation and Obscenity Section, the Domestic Security Section

and the Office of Special Investigations. Pretty robust portfolio.

An honors graduate of Columbia College and Harvard Law

School, Mr. Malcolm served as a law clerk to judges on both the

U.S. District Court for the Northern District of Georgia and the

11th Circuit Court of Appeals. For 7 years Mr. Malcolm was an Assistant U.S. Attorney in Atlanta, GA, where he was assigned to the

Fraud and Public Corruption Section. Mr. Malcolm also served as

an Associate Independent Counsel in Washington, DC, investigating fraud and abuse at HUD.

Prior to rejoining the Department of Justice in August 2001, Mr.

Malcolm was a partner at the Atlanta law firm of Malcolm &

Schroeder, LLP.

Thank you for sharing your time with us and look forward to

your testimony, and you are recognized for 5 minutes.

Mr. MALCOLM. Thank you for giving me this opportunity to testify about the Department of Justice’s ongoing efforts to protect our

Nation’s critical infrastructure from the growing problem of Internet borne worms and viruses. Although computer viruses have

been around for a long time, the ubiquity of Internet access and

household ownership of computers in the United States have manifestly increased the deleterious impact of viruses and worms on our

critical infrastructure and on our daily lives.

It seems that nearly every week we learn the name of a new

computer virus or worm that exploits flaws in commonly used software and quickly spreads through the Internet. Some of these, like

the Blaster worm, make the front pages of newspapers. These viruses and worms are merely the tip of the iceberg. They are just

the ones that receive the most public attention. Hundreds more are

released every year, posing a daily challenge to those who are responsible for protecting networks and investigating network attacks.

The effect of these viruses and worms should not be underestimated. For example, in the United States, the Slammer worm shut

down the automatic teller machine system and caused significant

transportation delays when electronic ticketing used for airline

travel was affected. The Blaster worm and its variants have affected hundreds of thousands of computers. Moreover, since the

Internet is seamless and borderless, the harmful impact of worms

and viruses is not limited to our country but affects countries

across the world. Clones or new variants of malicious codes continue to crop up, raising concerns that more damaging variants are

right around the corner. In many cases succeeding generations of

viruses and worms will build on its capabilities adding additional

harmful pay loads.

The worldwide damage to computers and data as well as the productive time lost as the result of worms and viruses is measured

in the millions and by some estimates in the billions of dollars.

This damage has an undeniable adverse effect on important sectors

57

of our economy and potentially undercuts the security of our Nation’s critical infrastructure.

The Department of justice has devoted significant resources to

investigating and prosecuting persons who release malicious codes

on the Internet. These efforts have met with some success. It bears

mentioning, however, that tracking the sources of worms and viruses on the Internet is difficult and presents unique challenges to

investigators because of the speed with which programs are spread

and fundamental characteristics of computer networks, particularly

in peer to peer network applications. It is difficult to determine

precisely where an outbreak begins since simultaneous file transfers can occur in computers literally throughout the world.

Although tracking the sources of computer worms and viruses is

difficult, the Department of Justice is fully committed to effectively

investigating such attacks. The Criminal Division’s Computer

Crime and Intellectual Property Section helps coordinate investigations of computer crimes of all sorts, including virus and worm attacks. These prosecutors in turn train and work with computer

hacking and intellectual property units and computer and telecommunications coordinators in each of the 93 U.S. Attorneys offices across the country. Together this network of prosecutors working with law enforcement agents from the Secret Service and the

FBI and using important tools provided by the Patriot Act provide

an integrated approach to addressing computer crime. Because the

perpetrators of offenses may live in other countries, the investigations involve an international component that draws upon the Department’s contacts with law enforcement counterparts abroad. Indeed, international cooperation is a foundation of the Department

strategy for combating cyber crimes, including worms and viruses.

Our efforts are rewarded whenever evidence is obtained from foreign countries that further domestic investigations or when we are

able to furnish similar assistance to other countries.

In addition to international outreach, Department attorneys and

agencies regularly meet with industry, trade groups and State and

local law enforcement officials in order to improve communication.

The Department of Justice pursues a message of a culture of security where both individual users and corporations view computer

security as a key component for successful computing experience.

Experience sadly teaches us that much of the damage to our computer networks is caused by teenagers and young adults armed

with free hacking tools, plenty of time and too little moral teaching

about how to use computers and how not to use computers. Therefore, the Department has also pursued educational programs directed to youth, their teachers and parents. We describe the program as cyber ethics. In fact, CCIPS, in an article authored by the

section chief, has published an article dealing with cyber ethics in

the current issue of Newsweek.

The Department of Justice continues to make progress in its battle against computer crime and intellectual property theft. Recognizing the challenges ahead, we look forward to continued success in our efforts.

Mr. Chairman, that concludes my prepared statement. I look forward to getting your questions.

[The prepared statement of Mr. Malcolm follows:]

58

59

60

61

62

63

64

65

66

67

68

69

70

Mr. PUTNAM. Thank you very much and thank all of you for your

adherence to our time restrictions. At this time I will introduce the

ranking member of the subcommittee, the distinguished gentleman

from Missouri, Mr. Clay.

Mr. CLAY. Thank you, Mr. Chairman, especially for calling this

hearing and my thanks to the witnesses who have taken the time

to be with us today and share their expertise.

Computer bugs like worms and viruses are one more example of

the complexity of the world we live in. On the other hand, they are

one more example of the frailty of human beings and the difficulty

of legislating appropriate behavior. Many worms and viruses we

have seen are nothing more than exuberance of youth experimenting with newly found freedoms and skill. As has always been the

case, the pranks of youth can have consequences well beyond their

capability to understand those consequences.

Last week, the FBI arrested a Minnesota high school senior and

charged him with intentionally causing and attempting to cause

damage to computers protected under Federal law. He faces a

$250,000 fine and 10 years in prison. This young man was so naive

that he built into his computer bug a direct link to his own computer. Catching him was not difficult. However, the damage done

was real. The worm attack he participated in forced shutdowns of

computer systems at the Federal Reserve Bank of Atlanta, the

Maryland Motor Vehicle Administration, the Minnesota Department of Transportation and part of 3M facilities, including a plant

in Hutchinson.

Unfortunately, most hackers are not as naive as this Minnesota

teenager nor as benign. One of the earliest publicly documented

cases of hacking was in 1988 at the Lawrence Berkley Lab. Cliff

Stone, an astronomer turned systems manager at Lawrence Berkley Lab, was alerted to the presence of an unauthorized user in the

inner system by a 75-cent accounting error. His investigations

eventually uncovered a spy ring that was breaking into government

computers stealing sensitive military information.

We are faced with developing public policy that recognizes both

the exuberance of youth and the real threat to our government and

corporations by those who seek to do us harm. One element of that

public policy must be a renewed attention to preventing these attacks.

Mr. Chairman, I will not go through this entire statement, but

I think you have indicated that you are working on legislation that

would encourage corporate America to do a better job of securing

their computers, and I look forward to working with you on that

legislation.

The problems faced by corporations are much like those facing

the Federal Government and we should work together to solve

those problems, and I will submit the entirety of my statement in

the record. Thank you.

[The prepared statement of Hon. Wm. Lacy Clay follows:]

71

72

73

74

75

Mr. PUTNAM. Thank you, Mr. Clay, and without objection your

entire statement will be included in the record. And at this time

I recognize the distinguished vice chair of the subcommittee, the

former Secretary of State of the great State of Michigan, Ms. Miller.

Mrs. MILLER. Thank you, Mr. Chairman, and I apologize for

being late this morning. I had an opportunity to speak on the floor

about the second anniversary of the horrific attacks on our Nation.

I certainly appreciate you holding the hearing today and with the

recent computer virus attacks on our Nation’s information infrastructure the importance of this hearing is undeniable, timely and

certainly appropriate. And with three panels testifying, I will be

very brief in my opening statement.

The focus of today’s hearing is to examine what steps are being

taken to protect the information infrastructure, both the public and

the private levels, from the spread of viruses. And we in the Federal Government certainly have the responsibility of protecting our

citizens and ensuring that the infrastructure individuals and businesses rely on is secure. In addition, the government must protect

its own systems in order to function efficiently and effectively and

this dual responsibility makes the task facing the Federal Government particularly challenging.

In April of this year testimony was submitted by Robert Dacey

of the GAO to the subcommittee citing a November 2002 cyber attack that affected both private and government networks and

caused $900,000 in damage to computers. This is obviously a significant figure. And if a large scale cyber attack were implemented

not only would the damage caused to computers be considerable

but the additional financial loss and damage to the physical infrastructure could seriously affect the operations of our Nation.

And actually we in the House of Representatives have firsthand

knowledge of how potentially devastating these viruses can be. The

recent Blaster and the SoBig virus attacks of just a few weeks ago

nearly crippled the House e-mail network by overloading service

with a complex array of erroneous messages. Fortunately, the combined efforts of the House Information Resources and the systems

administrators and the Members’ offices limited the extent of damage that the virus creators had likely hoped for.

In fact, these attacks likely inhibited our Nation’s ability to adequately respond to the vast power outage experienced by the eastern half of our Nation. I certainly shudder at the thought of what

could happen to everyday businesses if a successful virus or worm

crippled our Nation’s power grids or financial networks, the Internet, government networks or any other infrastructure that we rely

so heavily on.

Viruses are a new weapon of attack for those who wish to do

harm to this great Nation. The creators of these weapons are terrorists, quite frankly, cyber terrorists who want to disrupt our way

of life and to cause considerable harm to our economy and infrastructure. And as with the terrorists that we are fighting with conventional means, these cyber terrorists are using the freedoms that

we hold dear against us. They can unleash an attack on our soil

from anywhere in the world, and we must be prepared.

76

Mr. Chairman, thank you for holding this important hearing.

Certainly protecting our Nation’s information infrastructure must

be a top priority of the Congress. Thank you.

Mr. PUTNAM. Thank you very much, Mrs. Miller. We will get to

the questions.

Mr. Hale, what percentage of the Federal Government had already downloaded the patch for Blaster prior to its release?

Mr. HALE. Mr. Chairman, I don’t have the exact figure with me.

It is safe to say in the approximately 4 weeks between the time the

vulnerability was announced by Microsoft and the advisories from

FedCIRC were issued the vast majority of agencies had downloaded

the patches, and I will if given the opportunity try to provide you

a more measured answer in writing.

Mr. PUTNAM. What percentage of the Federal Government subscribes to FedCIRC’s program?

Mr. HALE. All Federal agencies receive advisories from FedCIRC,

the PADC program in specific; 47 Federal agencies are subscribing

to PADC. But PADC is just one part of an agency’s patch management strategy. And many agencies have other methods of getting

their patches, testing them and applying them. The information the

advisories provided by FedCIRC go to all agencies.

Mr. PUTNAM. So then, Mr. Lorentz, how many different options

are utilized by the various agencies to handle patch management?

Sounds like some contract with the private sector. Some do it internally. Some subscribe to PADC. So we’ve got a lot of different

patches to doing that.

Mr. LORENTZ. There are different approaches. We do not dictate

which method that they use. As part of our FISMA oversight, we

do require them to have specific plans, risk mitigation, patch management. We are soon to get the annual FISMA reports on September 22nd on that. But the important issue here, as you can tell

from the testimony of everyone here, is that the only way we’re

protected is if all the dots are connected, the configuration management, the patch management, the management oversight to make

sure those processes are implemented as appropriate, the adherence to the information provided by FedCIRC. So there can be variation in the tools, but there cannot be variation in the expected

outcome or how those dots are connected in order to mitigate the

problem.

Mr. PUTNAM. Mr. Malcolm, you mentioned a number of issues

about the law enforcement approach to computer security. How

many people have actually served time in jail for releasing malicious code, worms and viruses?

Mr. MALCOLM. There are a couple of instances that immediately

come to mind. One was Mafia Boy in the United States who was

actually prosecuted in Canada. He ended up getting a sentence.

There was David Smith, who was arrested and charged and successfully prosecuted for releasing the Melissa virus. I believe he got

a 20-month term of imprisonment.

I would add in that regard the U.S. Sentencing Commission is

reevaluating the guidelines as they apply to these sorts of offenses

and we expect significant increases. There have been other perpetrators who have been identified of course. Mr. Parsons was alleged to have—he has only been charged. He is presumed to be inVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00080 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
77

nocent. I don’t know if convicted of those offenses what kind of

prison term he would get. I can get back to you with a more precise

answer as to that.

Mr. PUTNAM. We have heard testimony that there are hundreds

of viruses per year and millions or maybe even into the billions of

damage done. Is there a different attitude or is there a different

approach about cyber crimes than there is about other types of

crimes? Has our sentencing guidelines, our judicial system, our

laws, our legislative branch not kept up with the technology that

can promulgate new types of threats?

Mr. MALCOLM. In terms of keeping up with the laws obviously

emerging technologies present all kinds of problems for law enforcement, and so we need to constantly reevaluate the state of our

laws. And USA Patriot Act, one of the provisions provides now for

nationwide service of process of pen trap orders and an explicit recognition. The pen trap orders apply to noncontent interceptions

over the Internet. That is an important step in conducting these

sorts of investigations.

I am not going to suggest that it is going to be the last such step

that is necessary. It’s certainly true that as these worms and viruses become more sophisticated and proliferate at a greater rate,

the potential damage is real. I think historically there has been a

perception that crimes taking place in the physical world are somehow more serious than crimes taking place over the cyber world.

I believe that perception is rapidly breaking down, and I expect the

prosecutions and sentences to increase.

Mr. PUTNAM. Mr. Pethia, Carnegie Mellon has done much more

work on this than anyone. I would like you to comment on this different attitude. When we had conversations with the private sector

when I was in Silicon Valley, the analogy is always used that people rattle their door knobs and rattle their locks thousands of times

per day depending on which firm it is. Obviously you have high

profile targets in the IT world and some are lower. But some are

getting thousands of door rattlings per day and they choose not to

report it. They don’t want to give any uneasiness to shareholders

or to consumers, so they just accept it as part of this Internet culture, and it results in hundreds of true viruses per year.

Is there a different attitude about the Internet and crime and

consequences?

Mr. PETHIA. I don’t know about different attitude, but I sense a

certain complacency, that people have become so accustomed to the

problem and are often so overwhelmed with the problem, so unable

on their own to change some of the root causes of the problem, that

they’ve simply chosen to live with it as best they can.

You’re right, many don’t report the attacks, but, again, many are

so trivial and so common that if you were to report them, it’s not

clear what anyone would do with all of that data. In fact, separating the wheat from the chaff, the serious attacks from the trivial,

has become an increasing challenge for all of us who do any kind

of instant response. Buried in all of this are the serious attacks like

the Blasters and the SoBigs and the people who are intent to do

malicious damage.

But, I think the widespread recognition is that the problem’s

here and it’s serious, but I think individuals don’t know what they

78

can do above and beyond putting controls in place in their own organizations.

Mr. PUTNAM. You don’t think that there’s necessarily a different

attitude about it?

Mr. PETHIA. I think it’s more an attitude of complacency and acceptance and just frustration over not knowing what steps that

they can take as individual organizations or as individuals to make

a difference.

Mr. PUTNAM. Have you ever heard of something called a Black

Hat convention?

Mr. PETHIA. Sure.

Mr. PUTNAM. What is that?

Mr. PETHIA. There are a number of different conferences. There

are two that are typically held every year about people who talk

about the Black Hat conference, or people who at one time wore

black hats, they broke into and attacked computer systems. That

conferences is now typically attended by white hats and not black

hats, but they talk about weaknesses in software. They talk about

what can be done to improve the situation. They talk about how

do we exploit some of these problems so they recognize very much

how widespread and serious this problem is, and in their own ways

they try to take steps to get corrections out to the world.

Mr. PUTNAM. What percentage of those who are attempting to

hack into computers and exploit code vulnerabilities, what percentage of them are bright, capable teenagers seeing what they can do,

and what percentage of them are malicious? What percentage are

based offshore, and what percentage are based domestically?

Mr. PETHIA. Those are good questions. I wish we had answers to

those. You know, we all have our guesses, but I don’t know of anyone who’s done any detailed studies about what’s called the Internet underground, what the composition of that culture is or even

what the economy is. There’s an underground economy that’s growing, that trades in things like account names and passwords and

Social Security numbers that are pirated and drivers’ license numbers that are pirated, and I don’t think any of us really has a good

understanding of what that culture is or how big it is or how many

different kinds of people play in it.

One thing that is really clear is that it is literally child’s play to

break into many of the systems that we have today, and when a

level of skill needed to attack a system is so low, you can expect

all kinds of players to come into that arena.

Mr. PUTNAM. When the conventioneers, whether they’re wearing

black hats or white hats, when they come together in the good of

their heart, talk about ways to improve the system and draw attention to different software companies’ vulnerabilities, do they ever

ask for money or credit or acknowledgment or anything in exchange for disclosing that information?

Mr. PETHIA. There certainly are cases where these individuals

have tried to extort money from vendors in order to not publicly

disclose patches or vulnerabilities in their products. We’ve certainly

seen cases where individuals have tried to extort organizations because they’ve uncovered weaknesses in their operational systems

and have expected money in return not to make that public or to

79

exploit those vulnerabilities in some way. So there is a maliciousness there in some cases.

Mr. PUTNAM. Mr. Malcolm, do you have any other comments

about the source and origin and nature of these hackers? Are they

primarily international, domestic, teens, professionals?

Mr. MALCOLM. I think you can really break that down into different categories in that you have a core group of committed, highly sophisticated hackers who come up with sophisticated worms

and viruses, and then unfortunately what they do frequently is

there are chat rooms and Internet sites, news groups in which

hackers communicate, and literally somebody who develops a very

sophisticated hacking tool can put it out there so that so-called

script kiddies, unsophisticated people who just happen to go to that

site, can then utilize that tool.

So the level of sophistication can vary dramatically among hackers, and because these tools are made available on the Internet,

lots of people can then implement them to cause damage. I think

that because the Internet is borderless and seamless, and there are

people who are hell-bent on destruction and technically savvy

around the world, you have perpetrators who are domestic and perpetrators who are international.

Mr. PUTNAM. Thank you very much.

Mr. Clay. The Chair recognizes.

Mr. CLAY. Thank you.

Let me ask any of the three, Mr. Dacey, Hale, and Lorentz: Did

the Department of Homeland Security collaborate effectively with

Microsoft and the antivirus companies in the Department’s effort

to issue advisories? And you can start, Mr. Lorentz.

Mr. LORENTZ. In our view, the proof is in the results. The problems were, for the most part, in general, mitigated, and there was

two pieces of that.

First of all was getting the information out about the remediation, which they did, and then was really following up and holding

the agencies accountable on our behalf, to make sure what the implementation was and reporting that back, and we did that in a

manner so that we could share what people’s experiences were. So,

in our view, it was in both of these incidents that we’ve had recently they did a find job.

Mr. PUTNAM. Thank you.

Mr. Dacey, anything to add?

Mr. DACEY. In terms of that, I’d just like to add one thing. We

did do some analysis and gathered information with respect to the

two vulnerabilities, the Microsoft RPC and the Cisco, and in those

cases there was a fairly active discussion and reporting that took

place on those two. As Mr. Lorentz indicated, for those two specifically, which were deemed critical, there were separate teleconferences and data requests that were sent out to agencies to ask,

you know, what they had done and whether or not they had

patched their systems in response to them.

I think that is a process which has taken place, I believe, on a

few of the occasions prior to this, but I know that there is some

opportunity there which would be acknowledged to improve that

process, to make sure that people have been communicated to in

a rapid manner by standardizing processes and procedures for that

80

communication to occur. But I would also defer to Mr. Hale, who

could probably speak more to the specifics of those interactions.

Mr. CLAY. Great.

Mr. HALE. Yes, sir. I appreciate the remarks of my colleagues,

and I just wanted to point out that those, as well as the Cisco vulnerability, the IOS vulnerability that has occurred in the past 3

months has been the major events in cyber incidents that have occurred since the formation of the national Cybersecurity Division,

and so those are indicative of the kind of coordination and collaboration that this Division has started to do and intends to build on

to improve not only the information-sharing among the Federal

agencies, but also with the critical infrastructure protection community.

Mr. CLAY. Let me ask you, Mr. Hale, in creating the Homeland

Security Department, Congress moved the Federal Computer Response Team from GSA to Homeland Security. How has this move

affected that group? Did anyone leave the Agency, rather than

move, as we saw with some other agencies, and did the move affect

the group’s ability to respond to any of the more recent attacks?

Mr. HALE. The effect was entirely positive, sir. The FedCIRC was

under GSA, had a focus on the security of Federal agencies in providing a service to Federal agencies, our customer base, and thanks

to the provisions of FISMA, Federal Information Security Management Act, FedCIRC was able to remain focused on that mission

and continue to provide our services to our customers. We didn’t

lose any staff members as a result of going to the Department of

Homeland Security; in fact, recruiting to fill our vacancies became

increasingly easier because there were a lot of people who were

very interested in becoming part of our efforts to help cybersecurity

and the Federal agencies, and by joining forces with the National

Infrastructure Protection Center and the other elements of NIAP,

we’ve actually improved our ability to gather information and disseminate information to the customer base.

Mr. CLAY. Let me ask you, Mr. Malcolm, recent viruses and

worms, such as Code Red, Nimbda, and Slammer, have brought

large portions of the Internet to a halt, caused extensive expenses

and lost revenue, and consumed the attention of tens of thousands

of computer security professionals, computer network administrators and users. These are serious crimes. Have law enforcement officials found and arrested the individual responsible for these viruses and worm attacks?

Mr. MALCOLM. They’ve also consumed the time and attention of

a lot of dedicated law enforcement agents. Of course, the Department doesn’t comment about ongoing investigations; however, I

think it is safe to say that with each of the worms and viruses you

have identified, those are all matters of ongoing investigation in

which we work cooperatively with our international counterparts.

We have some successes, as with the criminal complaint that’s

been filed in the variant ‘‘B’’ of the Blaster worm, but I think it is

safe to say that there is a lot more work to be done, and unfortunately, we not only have to act retroactively, but because these

worms and viruses come out weekly, we have to react prospectively

as well.

81

Mr. CLAY. Are the individuals who are responsible for these attacks, are they still at large today?

Mr. MALCOLM. Other than those who have been arrested either

here or overseas by international counterparts, yes, they’re still at

large, unless they’ve died.

Mr. CLAY. And you work with international law enforcement,

too?

Mr. MALCOLM. Twenty-four hours a day, 7 days a week.

Mr. CLAY. How many have you arrested out of the viruses that

I named, the three that I named, Code Red, Nimbda and Slammer?

Mr. MALCOLM. I don’t know the answer to that question. I believe they are all matters of ongoing investigation. I’m not sure off

the top of my head of any arrests in those particular cases, but I

can go back and check, and if there’s anything that’s a matter of

public information, I’d be happy to furnish it.

Mr. CLAY. Would you share that with us?

Mr. MALCOLM. If that’s public information, I certainly will.

Mr. CLAY. Thank you, Mr. Chairman. That’s all.

Mr. PUTNAM. Thank you.

Mrs. Miller.

Mrs. MILLER. I thank you, Mr. Chairman. I’ll just ask a couple

of questions here, but I think the nature of my questions are reiterating what all the committee members are talking about here

and what is really happening as far as the attitude that our Nation

has and our Justice Department, our law enforcement has toward

these cyberhackers.

You know, I was following here in the papers recently where the

recording industry has filed all these lawsuits against the file sharers. I know 200 lawsuits or whatever. Obviously, that’s not really

terrorism, unless you’re a recording star, you’re losing all this

money, right? But I was interested in the response of these college

kids who are downloading all this music and are getting sued, and

they certainly don’t care about that. We’re going to continue to

down—I mean, their attitude is unbelievably cavalier, I think, to

breaking the law by using electronic means to do so, and perhaps

that is part of the problem we have with these cyberhackers is the

attitude of our legislature, of our law enforcement; I mean, are we

serious enough? And as you were mentioning, some of the—you

know, is it just college kids who are doing this? Obviously not.

You’ve got the whole realm of different kinds of people who are

doing the cyberhacking.

Have you ever done a psychological profile? I mean, these people

are terrorists that are trying to shut down, as I was mentioning,

power grids or those kinds of things. That’s not downloading music.

Let me ask you first about that, as far as the Justice Department.

Has there been a psychological profile? I mean, there must be some

type of common trait, common element. It would be like an arsonist, right? You see the fire services do profiles of arsonists. These

are people that burn buildings and stand back, and there’s a whole

profile about these kinds of people that perpetrate that kind of

crime.

Mr. MALCOLM. I’m not aware of any psychological profile. I think

that perhaps I could contrast the situation with an arson in that

unless somebody wants to literally kill somebody inside a building,

82

arsonists tend to be motivated by one purpose, and that is collect

the insurance money.

In terms of hackers, I think you run the gamut. You obviously

have, perhaps, terrorists who are interested in exploiting critical

infrastructure for destructive ends. You can have political

‘‘hactivists’’ who go on to deface Web pages of something that they

are protesting. You have sophisticated hackers who take pleasure

in trying to stay one step ahead of the technological development

of law enforcement, who take pleasure in their ability to outwit law

enforcement by masking their activities. And you also have, as I

say, these script kiddies who are more or less with respect to their

use of the computers who were out there on a lark. They all cause

harm of varying degrees. We take them all seriously.

Mrs. MILLER. Let me just ask one other question in regard to the

Patriot Act. You mention the Patriot Act, and the Patriot Act, of

course, there’s been a lot of consternation talked about the Patriot

Act of whether or not privacy—a lot of privacy advocates are concerned about how the Patriot Act is being implemented, how you

are identifying and apprehending culprits.

I’m a supporter of the Patriot Act, and I’m just wondering how

that particular tool has assisted the Justice Department in our law

enforcement, and are a lot of these concerns being raised by the Patriot Act impeding your ability to prosecute, apprehend people,

identify them, etc.? How is the Patriot Act helping you?

Mr. MALCOLM. There are several questions in there that kind of

cut across a broad swath. Let me respond to the more narrow question, then I can fill in as you would like me to.

With respect to hacking investigation, any crime that is taking

place online, time is absolutely of the essence. If you can catch

somebody while they are in the act or trace their communications

either in real time or very shortly thereafter, your odds of catching

somebody go up dramatically. Internet service providers don’t retain records typically for a very long period of time, and people can

very quickly cover their tracks.

There are a number of provisions in the Patriot Act that help.

There is, one, the hacker trespass exception of the Patriot Act. If

somebody breaks into a system, the owner of that system now can

give consent to the government to go in and track the activities of

that hacker while they are taking place. Certainly the ability to go

and get a pen/trap order in one district and use that order to follow

the communications from ISP to ISP to ISP, to get those records

frozen as quickly as possible, has proven of invaluable assistance.

There are other tools such as nationwide service process for search

warrants, subpoenas, all of which have been instrumental in terms

of these investigations.

Mrs. MILLER. Thank you.

My last question just to the panel, I suppose. Obviously, the Federal Government has their own role to play in protecting our own

information and security systems and that, but I think the public

needs to be educated on security, computer security, as well. I’m

not sure who I’m asking this question to; any of the panelists, I

suppose. Do you have a feeling that there is a role for the Federal

Government to play in regards to educating the general public

about security safety and how important it is?

83

Mr. PETHIA. I’m going to start just by saying I think that’s something that I think is a strong role for the Federal Government, and

it needs to happen across the country with people of all ages and

all occupations. Starting at the elementary school level or where we

teach students about computer skills, we need to teach them about

computer ethics and the risks of working with computers and interacting in the Internet age. We teach our children how not to get

into cars with strangers. We should teach them how not to get into

chat rooms with strangers as well. So from there all the way up

through the home user, the retired home user, all of these people

are vulnerable to some kind of problems because of security or lack

of security on the Internet, and I think there is a strong role for

the government there to put together that kind of awareness, to

put together those kind of training programs and make them

broadly available.

Mr. LORENTZ. I think I would just add I think that our government has a responsibility to our citizens. As part of the management agenda, security is clearly one of the things we are looking

at. It cuts across public and private-sector activity. We do have a

role in clearly communicating what’s acceptable, what’s not, creating that common language, if you will, and it begins with exhibiting the behaviors that we would wish to see.

Mr. HALE. I would definitely endorse the statements. In fact,

with home computers being connected and always on, it’s nothing

short of a patriotic duty to maintain the security of your home computer because it can be used to attack other computers by other

people.

Mrs. MILLER. Thank you Mr. Chairman.

Mr. PUTNAM. Thank you, Mrs. Miller.

Mr. Malcolm, are there differences among nations in the laws regarding cybercrimes, and are there other nations who have particularly more effective means of enforcing them and have a greater

success rate in prosecution, and are there certain countries that are

more or less helpful to us in investigative work?

Mr. MALCOLM. I think the short answer to all of those questions

was yes. There are a couple of things that I can say in that regard.

One is we cooperated with our international counterparts throughout the world in terms of drafting the now—well, it hasn’t been

ratified in this country, but the now implemented accounts in the

Europe Cybercrime Convention. One of the beauties of the

cybercrime convention in addition to encouraging international cooperation is that it mandates signatory countries to update their

substantive and procedural laws with respect to computer hacking

offenses, which would include worms and viruses.

Mr. PUTNAM. Updates them to presumably a certain standard?

Mr. MALCOLM. That’s right.

Mr. PUTNAM. And are we already at that standard in the United

States?

Mr. MALCOLM. We’re constantly retinkering, but, yes, we try to

maintain the highest standard that we can. We work cooperatively

with Congress in that endeavor. And I would add that the Department of Justice, although not uniquely—the Department—the

State Department certainly, too—goes overseas and works with legVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00087 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
84

islators and law enforcement officers in other countries to try to

keep their laws updated as well.

From other entities, such as the G–8, there is a high-tech unit

that’s called the 24/7 network in which we are able to communicate

with law enforcement counterparts in these fast-breaking investigations on a moments notice, 24 hours a day, 7 days a week.

There are 30 countries that are members of the high-tech 24/7 network. We’re encouraging other countries to join. Some countries

have better facilities, training, more money to devote to this effort

than other countries, but we’re encouraging all of them to stay current.

Mr. PUTNAM. But you’re not aware of any one particular area of

the world that is a source of more hacking attempts than another?

Mr. MALCOLM. The answer to that question, with respect to

Internet piracy, with respect to hacking, I don’t know the answer

to that question, Congressman.

Mr. PUTNAM. Mr. Pethia, do you?

Mr. PETHIA. No, not that’s been sustained over any long period

of time. For a while, there were a number of viruses that for some

reason came out of Bulgaria, and you see short periods of time

where you’ll see an increase of activity from some geographic area,

but nothing that I know of that’s been sustained over a long period

of time.

Mr. PUTNAM. We may hear more about this in later panels. For

the OMB, how long does it take, because everyone has different

patch management systems—are you able to measure how long it

takes for all of the computers to download the patch when a particular vulnerability is released and the patch is also then released? Do you know when everyone has taken advantage of it?

Mr. LORENTZ. I can answer the more management aspect of that

and later get into the technical, because they basically act as our

agent in that. But we literally are advised of the vulnerability, we

call attention to the vulnerability. FedCIRC makes the agency

aware of what the remediation of the patch is, and then we specifically set a time to get back to monitor the adherence to the remediation.

And it’s in the last two incidents that’s exactly what we did, and

I would feel quite sure that FedCIRC probably has some cycle time

issues that they can look at in terms of how long it actually takes,

but, you know, there’s two aspects to all of this. The most significant aspect is the management aspect, and that is holding people

accountable once they know, and it’s mutually accountable to CIOs

as well. Once they know that there is an incursion, that the patch

has to be applied, and that there’s accountability to apply, then

there’s the obviously technical nature of things, and there’s a number of technical capabilities that are equally effective, but I would

pass it to Larry on the cycle time question.

Mr. HALE. For the 47 subscribers of patch C, we can tell when

they download, but even that is—can be a misleading statistic, because one download can serve thousands of computers, and an

agency may download one time and take care of their whole enterprise with that. So we’ve tried developing metrics with industry

with the software manufacturers, and that’s the constant refrain is

you can’t measure how many computers have been inoculated by

85

a single download, but it’s the best thing we’ve got is to tell that

agencies are downloading the patches.

Now, with the patch C system, agencies can also—once they’ve

inoculated their systems, they can enter in the report and say—it

requires a manual entry, but say that we’ve completed 90 percent

or we’ve completed 99 percent or 100 percent of computers affected

by this vulnerability, so there’s a method built in for reporting

back.

Mr. PUTNAM. Mr. Malcolm, if someone were to break into Coca

Cola’s headquarters in Atlanta and go into the office and steal the

recipe for Coca Cola, what would be a ballpark estimate assuming

they were arrested and convicted, what type of consequence would

they face for that?

Mr. MALCOLM. Mr. Chairman, there are a lot variables that

would go into answering that question.

Mr. PUTNAM. Ballpark. I’m not a judge.

Mr. MALCOLM. Well, in the interest of trademark infringement,

theft, I would estimate statutory penalties at 10 years or so, depending on whether or not the person has a prior record. That

would obviously affect their sentencing guidelines.

There are just too many variables for me to answer that question, without having a guideline book in front of me, but obviously

the factors are what are the charges, what is the severity of the

loss, what is the person’s past criminal record?

Mr. PUTNAM. Well, what would it be if they hacked into Coca

Cola’s computer system and downloaded the secret recipe?

Mr. MALCOLM. Same answer: You would have all sorts of variables as to whether or not they abused a position of trust, what

was the damage that they cased. It could obviously be, in the case

of Coca Cola, a major company, a major loss, a significant period

of time.

Mr. PUTNAM. Would it be significantly different than had they

physically taken it?

Mr. MALCOLM. There are different guidelines factors that would

take into account the fact that a computer was used, and special

skills were used, and, depending on who this person was, whether

or not they abused the position of trust. There are, under the sentencing guidelines—there are just too many individual case-specific

factors for me to give you an accurate answer to your question. I

think it is safe to say that if this was a major product and caused

a serious loss, I would expect the dollar figure to be high, and that

will dramatically increase the sentence since the major factor that

is taken into account by the sentencing guidelines is the loss to the

victim.

Mr. PUTNAM. OK. There are hundreds of viruses released every

year, according to the testimony of this panel. The damages range

into the billions, according to your testimony.

Mr. MALCOLM. Yes.

Mr. PUTNAM. If you could only recall two arrests, two convictions,

two jail times—you mentioned David Smith and one other.

Now, I asked, what’s the source of the threat? Well, we really

don’t know. Is it foreign or domestic? Well, we really don’t know.

That seems to reinforce a premise that cybercrime is treated vastly

different than some other crime that caused billions in damage and

86

shut down power grids and shut down departments of transportation and threatened security systems within and without the government. It would suggest that there is a different approach, a different attitude, a different level of concern about cybercrime. Would

you agree or disagree with that?

Mr. MALCOLM. I would reject that implication totally. There are,

of course, other instances in which perpetrators had been identified; for example, the fellow in the Philippines who promulgated

and released the ILOVEYOU virus. I would also say that there

are—you know, the Department of Justice is well aware, as is the

Department of Homeland Security, that cybervulnerabilities are

among the most critical problems that we have and could have a

dramatic impact in terms of protecting our critical infrastructure.

These are unusually complicated investigations in which very sophisticated people are very good at covering their tracks. To somehow suggest that just because there are fewer public arrests out

there in the media, that this is not an absolutely high, high, high

priority at the Department of Justice would be a completely wrong

assumption to make.

Mr. PUTNAM. OK. I take it at your word.

Any other questions from the subcommittee members?

Very well. We will dismiss panel one and seat panel two as

quickly as possible.

Thank you very much, gentlemen, for your input, and those of

you who can, we would encourage you to stay around and listen to

the private sector comments as well.

[Recess.]

Mr. PUTNAM. Very well. The subcommittee will reconvene.

I’ve asked panel two to rise and please be sworn in.

[Witnesses sworn.]

Mr. PUTNAM. Note, for the record, all the witnesses responded in

the affirmative.

We appreciate you being seated as quickly as possible, and we

will move straight to your testimony. I would ask that you be as

good about maintaining our 5-minute rule as the first panel was.

Our first witness is Mr. Gerhard Eschelbeck, overseeing Qualys’

engineering and operation. Gerhard Eschelbeck is responsible for

protecting over 1,100 corporate networks. He’s an internationally

recognized security and distribution systems expert and was recently recognized as 1 of the 25 most influential CTOs by

InfoWorld Media Group.

Prior to joining Qualys, Gerhard was senior vice president of engineering for security products at Network Associates; vice president of engineering of antivirus products at McAfee Associates. He

was a research scientist at the University of Linz, Austria, from

which he earned his Master’s and Ph.D. degrees in computer

science. He has authored many articles and papers and is inventor

of numerous patents in the field of network security automation,

and is a frequent speaker at networking and security conferences

worldwide.

Welcome.

Glad to have you at the subcommittee, and you’re recognized.

87

STATEMENTS OF GERHARD ESCHELBECK, CHIEF TECHNOLOGY OFFICER AND VICE PRESIDENT OF ENGINEERING,

QUALYS, INC.; CHRISTOPHER WYSOPAL, CO-FOUNDER, ORGANIZATION FOR INTERNET SAFETY AND DIRECTOR OF RESEARCH AND DEVELOPMENT, @STAKE.INC.; AND KEN SILVA,

VICE PRESIDENT, OPERATIONS AND INFRASTRUCTURE,

VERISIGN, INC.

Mr. ESCHELBECK. Mr. Chairman and members of the subcommittee, thank you for the invitation to testify about my research on

network vulnerabilities. The business of my company gives us a

front row seat to new threats against networked computers and

communications systems. Qualys provides an automated service

over the Web to audit the security of networks.

I’ve just analyzed more than 1.2 million network vulnerabilities

found by our virus scanning service during a recent 18-month period. This vast data pool demonstrates that known risks are far

more prevalent than anyone has imagined. Analytical data also

demonstrates a new breed of automated Internet-borne viruses and

worms that mock traditional security defenses.

The source of data for my analysis was anonymous results from

1.5 million security audit scans made by organizations worldwide.

We learned four themes that are called the laws of vulnerabilities.

The law of half-life talks about the fact that it takes an average

of about 30 days for organizations to fix 50 percent of their vulnerable systems within enterprises. The law of prevalence talks about

the fact that half of the most prevalent and critical vulnerabilities

are replaced by new ones each and every year. The law of persistence: Some old vulnerabilities recur due to the deployment of

unpatched software as part of new rollouts. The law of exploitation,

finally, talks about the fact that 80 percent of the vulnerability exploits are available within 60 days of public announcements.

Automating defenses against these threats is crucial, because

human-based efforts are not working. In each case of recent damaging strikes, we’ve had advanced warning; weeks, even months, to

prepare for known vulnerabilities, yet attackers were still able to

hit hundreds of thousands of PCs and servers.

Risks to network and system security are increasing because the

triggers are becoming automated, requiring no human action to deliver destructive payloads. Earlier first-generation threats are

virus-type attacks, spreading with e-mail and file-sharing. They require human action to trigger, such as opening an infected file attachment. An example would be the most recent SoBig virus.

Second-generation threats comprise active worms leveraging system and application vulnerabilities. Penetration occurs without requiring user action. Replication, identification, targeting of new victims are automatic. Blended threats are common, such as incorporating viruses and Trojans.

A third generation of threats is now posing trouble. We’ve already seen the potential for damage. The SQL Slammer worm rapidly hit more than 75,000 homes running Microsoft SQL server,

caused major damage worldwide. SQL Slammer was the fastest

worm ever, infecting more than 90 percent of the vulnerable systems within 10 minutes.

88

A few days after Microsoft published a DCOM vulnerability in

July 2003, Qualys’s automated scanning service ranked this security vulnerability as the most prevalent vulnerability ever. Following the laws of vulnerability, Blaster and its derivatives appeared

3 weeks later, infecting more than 100,000 systems per hour at its

peak. Urgency’s now rising from a shortening discovery/attack

cycle. SQL Slammer happened 6 months after discovery; Nimda

was 4 months; Slapper was 6 weeks; and Blaster and Nachi came

just 3 weeks after news of the vulnerability.

Public policy for network securities should strongly encourage

the use of automation as an equal force response to automated

tools used by attackers. Automating defense strategies include regular security audits of networks and systems, keeping antivirus

software up to date, timely patch management, and the ongoing

variation of security policy.

To summarize, many vulnerabilities linger, sometimes without

an end. New attacks are capable of spreading faster than any possible human response effort. Protecting our networks is a continuous process of eliminating critical vulnerabilities on the regional,

national and international scale.

In conclusion, public policy should demand timely detection and

a rapid application of remedies providing protection from these

threats.

Thank you for the opportunity to testify, and I look forward to

your questions.

Mr. PUTNAM. Thank you very much, Mr. Eschelbeck.

[The prepared statement of Mr. Eschelbeck follows:]

89

90

91

92

93

94

95

96

Mr. PUTNAM. Our next witness is Chris Wysopal. Mr. Wysopal is

director of research and development at @stake.Inc, managing

@stake’s pioneering research in application security. His primary

focus is building products to assure and test software security.

Working with vendors and the general public, Mr. Wysopal was

also responsible for managing @stake’s vulnerability research and

disclosure process.

His career in the information security industry has spanned over

13 years where he has held positions in industry while also serving

as regular advisor to various government agencies. Prior to joining

@stake, Mr. Wysopal was senior security engineer at GTE Internetworking, formerly known as BBN, where he was the most senior

engineer on the IT security staff. In addition, Mr. Wysopal is coauthor of the award-winning password-auditing program, LC3,

which is used by more than 2,000 government, military and corporate organizations worldwide. And, finally, he is a founding

member of the Organization for Internet Safety.

Welcome to the subcommittee. We look forward to your testimony.

Mr. WYSOPAL. Chairman Putnam and members of the committee,

thank you for inviting me to testify today on the subject of protecting the Nation’s computers from viruses and worms. This is a great

honor for me. My company @stake consults for the Fortune 1,000,

including four of the world’s top software companies. We help them

build more secure software and secure their infrastructures. I am

also a founding member of the Organization for Internet Safety.

OIS is a group of software vendors and security companies joined

together to produce a process for reporting and responding to new

vulnerability information safely.

Today I would like to cover three pertinent issues: The software

development process, the vulnerability research process, and finally, responsible vulnerability reporting and response. Unfortunately, in less than 72 hours, if an unpatched new computer is connected to the Internet, it will be compromised. This is indicative of

the software flaws that affect our information economy. My first

point is on software development, the root cause of the problem is

software flaws. Every virus or worm takes advantage of a security

flaw in the design or implementation of a software program. The

flaw can exist almost anywhere inside a program that processes

data directly from a network or from a file delivered by an e-mail

attachment. This means that practically every software program in

the age of the Internet falls into in the category of requiring security quality processes during its development. If these processes are

not in place and followed rigorously by the manufacturer, flaws will

inevitably creep into the software during development, be discovered, and end up exploited.

Automatic patching is a great solution for some computers, but

many environments have requirements that don’t allow patches to

be applied in automatic or even timely manual manner. One of the

key problems with patching is the Internet or the network the computer’s connected to is the distribution system. This means that a

computer needs to be connected to the Internet to be patched. The

irony is the Internet is the attack vector that puts the computer

at risk.

97

As recent examples of worms demonstrate, reactive solutions are

not keeping up with the speed of malicious programs. Many of the

flaws found in software after it is shipped to customers are not

found by the vendor. Many are found through directed research by

vulnerability researchers. These are individuals who investigate

the security of software for academic reasons, profit, or mere curiosity. A primary motivation of vulnerability research is altruistic.

There aren’t any independent or government watchdog groups looking out for the safety of the software—computer users’ use. Given

this vacuum, researchers feel that someone should test and find

vulnerabilities. They feel that every flaw they find and report is another flaw that will be fixed before a malicious person finds and exploits it. In this way, vulnerability researchers can make all computers users more safe.

Vulnerability researchers are performing a testing function that

should have been done as part of the security quality assurance

process by the vendor. Vulnerability researchers think differently

than traditional software testers. They think from the perspective

of an attacker. The fact that there is a vast amount of software already deployed with latent undiscovered flaws means that we will

be dealing with newly discovered vulnerabilities for the foreseeable

future.

A process for handling new vulnerability information in a timely

and safe way is required. There is some debate in the vulnerability

research community as to the best way to handle vulnerability information. However, most agree that it is responsible to inform the

vendor of the vulnerable product and give them time to create a

patch. 4,200 vulnerabilities were tracked by CERT last year. Almost all had patches available when the information became public

due to vulnerability researchers informing vendors prior to publicly

disclosing.

The Organization for Internet Safety has published a process

that these flaw-finders can use to report flaws to vendors and for

vendors to respond to these reports, sometimes with a patch. The

goal of the OIS process is to protect the computer user community

as a whole. A balance was struck between the timeliness and reliability of patches and between helping sophisticated users and the

majority of users who are unable to help themselves.

To conclude, software vendors face challenges building software.

Vulnerability researchers can help find the flaws that vendors

miss. Both need to come together to handle vulnerability safety. All

I ask is a step in this direction. Viruses and worms are shutting

down government offices and businesses for days. The impact

grows each year. When a technology contains dangerous, unseen

risks, we should have assurances that it is built properly. We need

the, ‘‘electrical code for building software,’’ and we need a way to

assure that the code is followed. This will reduce the risk of insecure software at its source and strengthen the computer infrastructure for us all.

Thank you.

Mr. PUTNAM. Thank you very much. Appreciate your input.

[The prepared statement of Mr. Wysopal follows:]

98

99

100

101

102

103

104

105

106

107

108

Mr. PUTNAM. Our next witness is Ken Silva. As vice president for

VeriSign’s networking and information security, Mr. Silva oversees

the mission-critical infrastructure for all network security and production IT services for VeriSign. In this role, he oversees the mission-critical network infrastructure for VeriSign’s three core business units: security services, naming and directory services, and

telecommunications services. His responsibilities include oversight

of the technical and network security for the definitive data base

of over 27 million Web addresses in dot-com and dot-net, the

world’s most recognizable top-level domains.

Additionally Mr. Silva coordinates the security oversight of

VeriSign’s Public Key Infrastructure security systems.

Mr. Silva serves on the board of directors for the Information

Technology, Information Sharing and Analysis Center, and the executive board of the International Security Alliance.

He advises and participates in a number of national and international committees for organizations, and he joined VeriSign with

more than 20 years’ experience in the telecommunications and security industry in his portfolio.

Welcome to the subcommittee. We’re delighted to have you.

You’re recognized.

Mr. SILVA. Thank you, Mr. Chairman and other members of the

subcommittee. VeriSign’s pleased to have the opportunity to provide our views on the epidemic virus and worm attacks that continue to threaten the integrity and security of information systems

we’ve all come to depend on. VeriSign is a company that’s perhaps

uniquely situated to observe the continuing assaults on our information infrastructure. Our company provides industry-leading

technologies in three relatively distinct yet interrelated lines of

business. These include telecommunications, infrastructure services, management security, and payment processing services, directory and naming services.

Our naming services is the business dedicated to the management of the domain name system, including our operation of the A

and J root servers. These are 2 of the servers out of the 13 servers

that allow you to find www.house.gov. Of the hundreds of millions

of machines on the Internet, it would direct you to the correct one.

In addition to that, for the last 10 years, we’ve managed the dotcom and dot-net top-level domains.

Since 2000, I’ve managed VeriSign’s resources dedicated to maintaining the security of these complex technology assets.

Today I would like to make three key points. First, we should not

underestimate the significance of these attacks. Although the most

recent worms and viruses have been labeled by some as nondestructive, they’ve cost American business in excess of $3.5 billion

in August alone. We can only imagine what the cost would have

been had these destroyed data along their path.

Second, we should accept our shared responsibilities. Each of us

has a responsibility. This includes lawmakers, government agencies, industry and private citizens. Government has a role both as

a model of good security practices, as well as a thought leader in

global security. Our citizens must be educated. We teach our children how to use computers in school, but do we teach them how

to use them responsibly?

109

Third, we must resist the temptation to demonize individual participants in the network community. The finger-pointing in general

is neither accurate nor helpful. It’s all too easy to blame the operating systems manufacturer for flaws in their code or the network

providers for not securing their networks. Many of the worms attack not only popular operating systems, but open source software

as well.

Mr. Chairman, there are measures which will over time improve

the security posture of our network, but there is no silver bullet

that will miraculously solve our network security challenges.

VeriSign’s role over past decade has led us to make significant

investments in network hardware, engineering, research and development. Armed with that knowledge, we can deploy and advise others on the network how to deploy the very best configurations and

maintain the stable and secure functioning of the Internet.

VeriSign’s unique monitoring capabilities allow us to watch as the

virus propagates around the global network. As a result of

VeriSign’s constant vigilance, we’re often among the first to recognize it, and as an attack develops—you can see our view up here

shows our global constellation. I brought another slide with me,

which is an example of the graphic data that we’re able to monitor.

This one shows a propagation of the SoBig.F virus in just a short

6-hour span on August 19.

There’s another one following that, the next graphic, please,

which today just happens to be the very day that this virus has decided to disarm itself. This was taken this morning.

Following the September 11 attacks, we provided some of these

monitoring capabilities to both the Defense Department’s NCS and

the FBI’s NIPC, to enable them to observe and detect anonymous

traffic on the network.

Our long experience and the most recent events like Blaster

worm reveal fundamental truths about our networks in the attacks. A few years ago, these things took months or weeks to propagate. Now they propagate in hours or minutes. Not only are the

weapons behaving more aggressively, they’re increasing their

uniqueness, making selection of appropriate countermeasures difficult and uncertain. As a result of this growing risk and our growing dependency on our networks, I believe we must face up to the

reality that these network attacks are every bit as threatening as

physical attacks on critical infrastructures, warranting serious attention to strategies to defend against them and remedy their impact. Even when they don’t bring down the network of a targeted

site, the insult to the network’s integrity still has observable and

measurable consequences.

Another level of damage, these attacks fundamentally threaten

the core assets of the Internet, including the Internet root servers

and top-level domains. There are larger costs to these attacks.

I’d like to thank you for giving me the opportunity to appear before you today. Thank you.

Mr. PUTNAM. Thank you very much, Mr. Silva, and I appreciate

your—all of you limiting your remarks to the 5 minutes.

[The prepared statement of Mr. Silva follows:]

110

111

112

113

114

115

116

117

Mr. PUTNAM. Mr. Silva, I get the impression that you had to cut

yours a little bit short, so I’m going to give you the opportunity to

expand on it by asking my first question about root servers. And,

if you will, just take us in nontechnical terms to their role in the

architecture of the Internet, and what their vulnerabilities have

been in the past two viruses and worms, and what impact that

could have in economic terms.

Mr. SILVA. OK. Well, Mr. Chairman, the root servers are sort of

the top of the Internet naming system, if you will. There’s an invisible period at the end of every domain name that people don’t see,

and that happens to be the root, and, then from there it goes.com;

then, you know, Microsoft.com; and then www, etc. They’re sort of

at that very top level. No other computers can be found without the

information that these provide. And then there’s another layer

down from that which VeriSign also operates, for dot-com and dotnet.

The SoBig.F worm in particular had a unique attack that it presented on the A root server, and that the A and B root servers

were—it’s where that—that worm first looked to find out where an

e-mail was supposed to be sent, OK? So if they wanted to send it

to, you know, anyone, it would simply look to the root server first

to find out where that mail server was.

Now, in the Blaster worm, that didn’t actually have an impact

directly on the root servers themselves, because there was no protocol that the root servers were running or a particular name lookup that was required for that worm to spread.

Mr. PUTNAM. You mentioned and other panelists have made allusions to open source versus proprietary. Is one less vulnerable than

the other, or if you would just comment a bit on the old debate between proprietary and open-source software, again, beginning with

Mr. Wysopal. Let Mr. Silva think about his for a second.

Mr. WYSOPAL. The theory with open-source software is that it

can be made more secure because there’s more eyes. Every single

user has the potential, if they have the skill set, to find flaws in

that software and then correct them for themselves or notify the

maintainer to correct them. With proprietary software, the user

has no way really of looking deeply into the software by examining

the code, but, practically, users of open-source software are not expert code reviewers and don’t have the time to actually review the

code, so we see vulnerabilities sort of in equal proportion in both

the open-source world and in the proprietary software world.

Mr. PUTNAM. Mr. Silva.

Mr. SILVA. Yeah. I would agree mostly with what he said, except

that there always has been this statement that, in the open-source

world, the source code’s available, and if you were running it, you

could certainly look at it. I doubt seriously that you would know,

99.99 percent of the rest of the people who use it.

In addition to the people who use the software not necessarily

being expert code reviewers, in many of the cases people actually

writing the software are not actually expert software writers either. So it’s not that it’s bad software, it certainly is good software,

but it’s no more or less vulnerable than the software that goes

through rigid configuration, management, and software review

standards.

118

Mr. PUTNAM. Mr. Eschelbeck, would you like to weigh in?

Mr. ESCHELBECK. I do not necessarily see a relation between

open source versus closed source from a vulnerability prevalence

perspective. I don’t think there is any analytical data that would

support that.

However, I do believe strongly that software that’s more popular,

more widely used out there has been reviewed much more widely

and is more popular, and that’s one of the main reasons why I

think there is more vulnerabilities known about a software that’s

used widely rather than a software package that’s not used at all

out there.

Mr. PUTNAM. What would be the impact of, in terms of improved

Internet security, if any, of the next generation of Internet, IPv6?

Does that in any way alter security concerns?

Mr. WYSOPAL. I don’t think IPv6 really alters the security concerns. What IPv6 does is it makes many more Internet addresses

available, so we can have an Internet address for, you know, your

wristwatch or any small object you could have, thousands or millions of times more Internet addresses with IPv6. It doesn’t really

address any security issues.

Mr. SILVA. Well, actually, it does address some security issues,

although probably not for the masses. There are protocols that are

part of the IPv6 standard that would allow better authentication

between IP addresses as they connect. Some of those capabilities

have since been transferred to IPv4, such as the IP SAC, which is

what many of the BPM tunnels use today, but for the general Web

server, probably not.

You know, just for the average computer on the network that

doesn’t need to authenticate every single user, it’s probably not

going to offer anything new for them.

Mr. PUTNAM. Mr. Eschelbeck, do you wish to add anything?

Mr. ESCHELBECK. I would say exactly the same thing. I think

there is a lot of improvements in IPv6, and it’s clearly the right

step in the right direction, but there is still pieces missing that we

don’t do in IPv6 today, like in the new protocols that are coming

up. And particularly if you look from a vulnerability perspective,

IPv6 is not going to address the vulnerability problem. That’s really the reality why we are here today, why we’re looking for

vulnerabilities and how to address them. So IPv6 is certainly the

way to move from an authentication, from an encryption perspective, and it would fix some of those underlying issues, but would

not fix all of the security issues that we are facing today.

Mr. PUTNAM. Thank you. I will stop there and recognize the

ranking member, Mr. Clay.

Mr. CLAY. Thank you, Mr. Chairman. And any one of you can attempt to answer these questions.

Let me start out by asking: What motivates people to engage in

computer hacking?

I mean, let’s start on this end of the table.

Mr. ESCHELBECK. I do think that there is—obviously, if you look

back in history, mostly what we have seen, some of the attacks

really didn’t have any specific target in mind. They were mostly

like who is the first who is going to launch a worm on the Internet,

119

and that was the results we have seen in traffic congestion, things

like that. But I clearly see moving forward motives in mind.

If I look at Blaster, it was probably the biggest turning point we

have seen here by Blaster introducing the ability to deliver a payload that actually does something malicious, other than just creating noise on the Internet. And in this particular case with Blaster

was the denial of service attack against Microsoft, and I do see

some transit that is clearly the opportunity for more active payloads coming in future worms. They were motivated by motives

that we don’t know and fully understand at all.

Mr. CLAY. Mr. Wysopal.

Mr. WYSOPAL. I think the main motivation is experimentation

and exploration, but these people who do this experimentation

don’t take into account any sense of ethics, and they don’t really

care that their experiments cause harm to others.

Mr. CLAY. Mr. Silva, what do you think about it?

Mr. SILVA. I don’t really have anything to add.

Mr. CLAY. All right. Let me ask you, there has been much discussion about information-sharing and cyber vulnerability issues between the government and the private sector, and within the private sector are there any legal or policy barriers that continue to

impede information-sharing and cooperation?

Mr. Silva, we can start with you.

Mr. SILVA. Well, there are a number of issues related to antitrust, OK, that have been raised amongst companies sharing information, amongst a select group of people, that’s not publicly available. More recently—or, excuse me, prior to that, one of the issues

was FOIA, quite frankly, sharing information between government

and industries and having, you know, the possibility that a publicly

traded company with, you know, some known vulnerability that if

they made that information available to the government would

somehow be available through FOIA. Some action has been taken

in that direction, but those are probably the two main impediments

there.

Mr. WYSOPAL. I think another main impediment is companies

trying to refrain from looking embarrassed basically. A lot of companies such as financial services companies banks are among the

most trusted financial institutions, and people expect the highest

level of assurances to protect their money, you know, their privacy,

and it could be embarrassing. It could be a competitive advantage

of some of their competitors to say, you know, put your money with

us. You know, your privacy will really be protected with us. They

say they do, but look at this, this, and this. So I think a lot of it

is competition and fear of embarrassment.

Mr. CLAY. Very interesting.

Yes, Mr. Eschelbeck?

Mr. ESCHELBECK. I would actually agree with Chris’s statement.

I would like to add one point here. What we see as well is those

areas, those sectors, in general that are—have legislation for auditing requirements, for security auditing requirements, we see a bigger sense of urgency there in comparison to some of the areas that

are not legislated today.

Mr. CLAY. Going back to attacks and computer hacking, do any

of you have any knowledge of foreign governments involved in

120

cyberattacks. How is that different from hackers attacking for the

fun of it?

Let’s start with you, Mr Wysopal.

Mr. WYSOPAL. It’s very difficult to say where some of the malicious code, the exploit code, that’s written or where some of this

vulnerability research comes from. It’s difficult to say whether it’s

a foreign government, or it’s just an individual in a foreign country.

When we see some malicious code, we certainly see levels of sophistication that are equal to the most sophisticated in the world coming from countries such as China. It’s fairly easy to tell because of

the language differences where some of this is coming from, but it’s

very difficult to tell whether it’s actually government-sponsored or

just academics or just, you know, black hats.

Mr. CLAY. Anybody else got anything to add?

Mr. Silva.

Mr. SILVA. Well, I think probably law enforcement intelligence

representatives could probably answer the question as to the foreign sponsorship of the hacking probably better than any of us here

could, but I have to say that I think most of these, at least from

earlier testimony, have actually been caught. The few of that have

actually been caught have turned out to be young adults or teenagers.

While I think we should be concerned about terrorist sponsorship

or state-sponsored hacking and malicious activity, I think we

should definitely not discard the fact that the vast majority of these

appear to be coming from, you know, pranksters, OK, that have no

political affiliation or governmental sponsorship. So, while I think

it’s important that we know if it is state-sponsored, I don’t think

that all of our efforts should be focused in that direction.

Mr. CLAY. Perhaps any one of you can take a stab at this, but

can the Federal Government use its procurement power to improve

the security of computer software? Anybody have a thought on

that?

Mr. WYSOPAL. I think definitely. The Federal Government is

probably the largest purchaser of technology, especially software,

and one thing that doesn’t happen when people purchase software

is an acceptance test for the security of that software. Sometimes

it’s acceptance testing that has certain features or has a certain

level of performance, but acceptance testing for security is more expensive and time-consuming, so no one really does it.

If the Federal Government was to do that, the benefits would be

all the users of that software, because the Federal Government

could say, you know, we spent a lot of money and tested this, and

we rejected it, and we need to go back to the drawing board and

build something secure. I think if that happened, the other users

of software would say—or potential purchasers of the software

would think twice about buying it, if the government wasn’t willing

to use it.

Mr. CLAY. Thank you. Thank you very much, Mr. Chairman.

Thank you very much, Mr. Chairman.

Mr. PUTNAM. Mrs. Miller.

Mrs. MILLER. Thank you, Mr. Chairman. I am going to pick up

on the ranking member’s question here, but I think we are all

struggling with this panel, members of the committee, with this

121

panel on understanding what is the appropriate role of the Federal

Government.

And you are in the private sector, and—I mean, I am a person

that generally thinks that less government is better and less government regulation is better. But because our society is becoming

so unbelievably dependent on the Internet, on computers for communication purposes and for security purposes, for everything, the

term ‘‘vulnerability researcher,’’ I guess I never really heard that

before, as I listen to you say it. Now it is going to be part of my

nomenclature here. But it’s very descriptive, and I can understand

what you’re talking about there.

Do you think that the Federal Government, first of all, has an

oversight role? Should we be using our purchasing power to set

standards out for software? What is the fine line of the government

not overregulating private industry, but certainly having consternation about some of the security problems that are inherent

in software? What would your suggestion be on how far you think

the government should be going here, and what is the appropriate

action for the Federal Government?

I mean, we just had this huge power outage in my State of

Michigan, and we are looking to the Public Service Commission to

regulate an industry. And I’m trying to understand everything

about the energy policy of our Nation, but I could not tell you what

the proper amount for a person to pay per kilowatt hour actually

is. We rely on the experts.

You are the experts in the software industry; and I think we are

trying to struggle to understand what we need to do appropriately

without overstepping our bounds into the private sector.

Mr. WYSOPAL. Well, one place where I think it’s important for

the government to regulate is when we get to issues of safety, you

know, when we are talking about cars or airplanes or chemicals or

things like that.

Regulation of safety is important. There used to be, you know,

something that you write documents with and safety wasn’t an

issue. But now when we’re seeing these networks being interconnected with things like the power grid actually being connected

directly to the Internet, you know, through maybe a few gateways,

but you know, the worms got in. You know the worms can get inside, start to get to the issue of safety. And that’s a place where

I think some regulation is appropriate.

You know, the software industry is a fast-moving industry and

putting any regulation on it is certainly going to slow down innovation. There’s no doubt about it. But maybe it’s time to think about

some limited safety regulations.

Mr. SILVA. I think that there’s a fundamental role of our government, whether Federal Government or State government, to provide education to our people, to our citizens. If any of you happen

to have a DSL or cable modem at home and would actually install

a firewall on it and look at the logs, you would be shocked at the

number of times penetration attempts actually hit your machine.

It would just boggle your mind; it really would.

But as I said in my testimony, or in my statement, we teach our

children in almost every school in the country, we teach them how

to use computers, how to use a word processor, how to boot a disk,

122

but we don’t actually teach them how to responsibly use the computers and what the consequences of their actions or inactions actually are. So I think that’s a role that the Federal Government

can play, as well as State government.

Mr. ESCHELBECK. I think there are two areas, looking at it. On

the one side we have, obviously, existing infrastructure that we

need to look at from a security perspective, and that’s probably

going to give us an effort for the next 5 or 10 years. And there are

specific ideas how those could be handled.

However, there is the new software aspect when new software

comes out, there are standards in place like common criteria that

are being used to secure—to improve security software. Such standards are not existing for any commercial-type applications. I am

not asking for common criteria-type certification for any type of

software, but some lightweight certification would give at least a

seal of approval from a security perspective as far as the new technology that is coming out there.

As far as the existing infrastructure we have in place today, I

think we have to give the leadership perspective infrastructure so

they can measure. The key part is, how do I measure security

today. There are no tools or well-defined metrics out there. And I

think we have to give the leadership and the government, and industry as well, infrastructure tools and ways to measure their security, so that they can say, I am at the level 4, I am at the level

5, and in comparison to other agencies, for example, I am at this

level.

So there are ways I think those could be accomplished by putting

infrastructure in place there.

Mrs. MILLER. No other questions. Just a comment.

I certainly picked up from both of the panels how important it

is for education. You know, really the Internet is still relatively a

new phenomenon. Ten years ago, 20 years ago, many people had

not heard of the Internet or were not using it every day. The children now, of course—and perhaps it is generational—are leaping

onto these computers.

I was struggling yesterday trying to download my boarding pass,

and all these things keep coming up on my computer saying,

upload this right now or your computer is going to blow up or

something. I’m trying to understand it all.

But at any rate I certainly appreciate the testimony here today,

and I think the government certainly recognizes again that society

is becoming so dependent on electronic technology and how important it is for every generation to understand what the implications

are of some of the cyber hacking, and how important it is for them

to be able to use these tools properly and understand the ramifications of what they’re up to.

Thank you.

Mr. PUTNAM. Thank you, Mrs. Miller.

Mr. Wysopal, if you would, you probably made the most extensive comments about researchers. Tell us a little bit about the category of researchers who would not be classified as altruistic, and

their motivations; and I’m not asking you to psychoanalyze them,

but how big a group are we talking about? Do they seek fame, seek

money or simply the thrill of being able to discover the source code?

123

Mr. WYSOPAL. I think it’s mostly the thrill of having power over

computers on the Internet. Part of the way that they keep score is

how many systems, you know, have you compromised—the vulnerability that you discovered and wrote exploit tools for or malicious

code for, how many computers can you compromise with that.

So a bug that was exploited in a software package that was used

by 100 people, no one will care about, but if you find a bug in a

Microsoft piece of software which is used by millions of people, then

you are looked at amongst your malicious peers as more important

and a better black hat.

And this is definitely a very serious problem that people are able

to find these vulnerabilities, and usually they keep them to themselves. They don’t tell the vendors. They keep them to themselves

or share them amongst a small group of people. So they can go into

computers with impunity on the Internet and know that problem

won’t be patched.

And that’s a very difficult problem to control. The only way to

control that is to actually design the software without the flaws to

begin with.

Mr. PUTNAM. And that is an impossibility, right, to have a truly

foolproof code?

Mr. WYSOPAL. Yes. There’s no such thing as 100 percent secure.

But as a company, we do security quality testing for many different

software vendors, and we see a vast difference in the number of

flaws we find in a piece of software which was developed by a secure development process. Where training was given to the developers, they thought about security through the entire phase, from

design implementation to test, versus software where security is

really an afterthought; where after the product is shipped, people

say, maybe we should think about how to configure it better.

When it isn’t thought of from the very beginning, there is a big

difference in the number of flaws that end up in the end product.

Mr. PUTNAM. Mr. Silva, you mentioned rule No. 2 was for everyone to accept more responsibility. You discussed the importance of

education and things of that nature.

But with the prevalence of broadband, has responsibility shifted

somewhat to providers or to cable operators or to telecommunications companies whose history and tradition and corporate culture would not ordinarily lead them to believe that protection

against hackers or firewalls would be something of their responsibility?

Mr. SILVA. Well, as I said in my statement, it is a responsibility

of everyone, and I think—we always sort of gravitate to the natural

thing to do, which is to sort of look at, is this not somebody else,

is the responsibility shifting from one group to another?

I don’t think it’s shifting; I think it’s never changed. I think that

ISPs, the people that we all use to connect to the Internet, have

some level of responsibility. I think that the government, that industry, my company as well as all of the others, have a responsibility to do their part.

For instance, the Blaster worm has been running around the

Internet now for weeks, and the network providers are carrying the

traffic around it. One would think they would see that traffic movVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00127 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
124

ing around in the network and either deal with it or at least work

with a group of people to try to figure out how to mitigate this.

At the same time, if they were to suddenly block that traffic, you

know, I can assure you it will create other problems on the Internet. So I think we just have to work together and we have to find

out what that magic fingerprint is.

There are a lot of these companies that are carrying this traffic

that aren’t in the best of financial shapes right now and probably

aren’t going to invest hundreds of millions of dollars into research

and mitigation methods.

Mr. PUTNAM. Thank you very much.

Is there anything that you have not been asked that you wish

to comment on or perhaps respond to as a result of panel one, or

do you have any additional comments before we seat panel three?

Thank you all very much for your assistance and your input.

With that, we dismiss panel two and seat panel three as quickly

as possible. And the committee is in recess.

[Recess.]

Mr. PUTNAM. We have panel three seated, and the committee

will come back together. And I would ask that you rise, please, and

raise your right hands to be sworn in.

[Witnesses sworn.]

Mr. PUTNAM. Let the record show that all the witnesses have answered in the affirmative.

We will go straight to your testimony, and I would ask that you

follow the examples of panels one and two and adhere to our 5-

minute rule on opening statements. And I will introduce our first

witness.

Greg Akers is senior vice president and chief technology officer

for three strategic areas at Cisco—customer advocacy technology,

corporate strategic security programs and government solutions.

Within customer advocacy technology he and his team focused on

how to most effectively use technology to improve Cisco’s productivity and strengthen Cisco’s relationships with its valued customers.

Specific initiatives include technology engineering, autonomic and

adaptive networking, cross-customer advocacy research and development functions, and Internet capabilities integration.

He also leads Cisco’s corporate strategic security programs with

a focus on information security, intellectual property, security solution certifications, and cyber warfare.

Additionally, Mr. Akers runs a government solutions team to address the unique requirements of government. The mission of this

team is to provide solutions aimed at government’s core business,

enabling achievements of its mission to protect its citizenry. He has

dedicated teams to address global defense in space, critical infrastructure protection, U.S. homeland security challenges and a government systems unit. His primary focus will be to adapt Cisco

products and services to respond to the unique requirements.

Welcome to the subcommittee. We are delighted to have you. You

are recognized.

125

STATEMENTS OF GREG AKERS, SENIOR VICE PRESIDENT,

CHIEF TECHNOLOGY OFFICER, GOVERNMENT SOLUTIONS

AND CORPORATE SECURITY PROGRAMS, CISCO SYSTEMS,

INC.; PHIL REITINGER, SENIOR SECURITY STRATEGIST,

MICROSOFT CORP.; VINCENT GULLOTTO, VICE PRESIDENT,

ANTIVIRUS EMERGENCY RESPONSE TEAM, NETWORK ASSOCIATES, INC.; AND JOHN SCHWARZ, PRESIDENT AND CHIEF

OPERATING OFFICER, SYMANTEC CORP.

Mr. AKERS. Thank you. Chairman Putnam, Ranking Member

Clay, thank you very much for the opportunity to testify today on

this very important issue.

Cisco is a provider of networking infrastructure for the Internet

and intranets of all types. We provide end-to-end network solutions, connecting people to computers and networks all over the

world, and align the work-play-live-and-learn without regards to

differences in time, place, or type of computer they happen to use.

Roughly 80 percent of Cisco’s support transactions and 85 percent of Cisco’s sales transactions are completed over our own company Web site. Therefore, we are very concerned about threats and

the correct operation of the infrastructure of the Internet.

Rather than summarize the details already provided in my written testimony, in the short time today, I would like to provide recommendations to three specific groups—industry, individuals, and

government—with specific actions to address some of these threats.

Vulnerabilities can never be completely eliminated, as has been

previously stated. Establishing a product security response capability is a huge step toward reducing the threat. Another major improvement is gathering by setting up obvious e-mail and easy-touse Web pages, by vendors and customers alike, so they are easily

accessible, that will allow vendors to produce results for incidents

as they incur.

Most vendors today neither have a team nor modification methods in place. Industry members can contribute greatly by establishing and publicizing product security processes, including taking

minimum steps to establish a response team and create necessary

links to facilitate incoming reports and outgoing announcements.

External reports of vulnerabilities are often accompanied with

demands to publish in a short period of time, less time than the

vendor needs to develop fixed software and work around and test

these fixes completely. The public is generally unaware of the internal constraints influencing the vendors’ schedules.

Because every vulnerability and vendor is unique, time lines

should be adjusted by the vendor and the external party for each

situation individually. Vendors can help by streamlining their own

schedules for producing software and by establishing expectations

for negotiating flexible but effective time lines with all external

parties.

Many individuals and groups fail to practice confidentiality regarding vulnerabilities and fail to maintain computer and networking systems at some moderate reasonable base line and vulnerability. The consequences can be severe. Individuals should act

responsibly regarding vulnerability information. We have published

the security advisories and encourage others to do the same.

126

Some practice poor control over the need-to-know information regarding vulnerability. Some lack timeliness or otherwise detract

from the overall success of the process. Numerous plans have been

derailed or completely rerouted due to leaks, made more severe by

late arrival of information or otherwise slowed down by lack of information or improper information.

Participants are responsible for reporting vulnerabilities promptly and solely to the appropriate recipient, protecting the confidentiality and lending assistance as they are able to. Vendor-neutral

coordinating centers are valuable conduits for reporting and handling vulnerabilities. The trust placed in such organizations by the

worldwide network security community for the criticality of important coordination function might be jeopardized if it becomes too

dependent on funding or other centralized government control, or

any one individual entity within industry or the public sector.

Government should ensure that coordinating centers are available, receive adequate funding from multiple sources and avoid dependencies that will treat any participant unevenly or in any other

way unfairly. Many are aware of the issue with the ‘‘script

kiddies,’’ but not are aware of the professional ‘‘black hats’’ who

work for a combination of organized crime, terrorists, or nationstates. An entire marketplace that exploits vulnerabilities has

sprung up on the Net and has easy-to-use tools, yet it is virtually

unknown to the public.

Government should increase funding and support for the development of the maturation of cyber intelligence, the advancement of

information sharing, and the overall improvement of law enforcement’s ability to prosecute cyber crimes. One issue is common to

all the action groups: Vendors respond to customers’ demands. Buyers from all of these groups wield considerable influence at purchasing time. If product security or response team are important

to you, the buyer should vote with the wallet.

Specifying systems that meet the demands for more security are

inevitably the ways vendors will respond, to include increased security measures in their products. Industry, individuals, and government can set effective examples for defining base line security requirements and require compliance to these simply by completion

of sales.

The global nature of the Internet means that no single country

or industry group can address vulnerabilities in isolation. Success

in this arena requires public-private cooperation between all three

of these entities.

As an example, consider the cooperation industry under the auspices of a national infrastructure assurance council, developing a

vulnerability disclosure framework that should prove to be useful

to all parties. The industry leaders I work with understand the

roles and are willing to do their part to protect our national and

economic security. The recommendations presented here would be

a good starting point for improving the security posture for the entire Internet.

127

I want to thank you, Mr. Chairman, and the other subcommittee

members for inviting me today. And I will be happy to answer any

questions that you may have.

Mr. PUTNAM. Thank you very much Mr. Akers.

[The prepared statement of Mr. Akers follows:]

128

129

130

131

132

133

134

135

136

137

138

139

140

Mr. PUTNAM. Our next witness is Philip Reitinger. Mr. Reitinger

is a senior security strategist with Microsoft Corp.’s Trustworthy

Computing security team. The Trustworthy Computing Initiative

at Microsoft is a long-term, company-wide initiative to promote the

values of reliability, security, privacy and business integrity.

Before joining Microsoft in January 2003, Mr. Reitinger was the

Executive Director of the Department of Defense’s Cyber Crime

Center and the Deputy Chief of the computer crime and intellectual property section of the Criminal Division of the Department of

Justice.

Mr. Reitinger is the former Chair of both the Group of Eight’s

High Tech Subgroup and the National Cyber Crime Training Partnership’s Vision and Policy Committee.

We look forward to your testimony, Mr. Reitinger, and you are

recognized for 5 minutes.

Mr. REITINGER. Good morning, Chairman Putnam, Ranking

Member Clay. My name is Philip Reitinger, and I am a senior security strategist with Microsoft. I want to thank you for the opportunity to appear here today.

Before joining Microsoft, as the chairman noted, I was the Deputy Chief of the Computer Crime and Intellectual Property Section

of the Department of Justice, the Executive Director of the DOD

Cyber Crime Center and the Chair of the G8 Subgroup on high

tech crime. Thus, for some time I have been concerned with criminal threats to people and networks and with the challenges posed

by responding to cyber crime.

Responding to those challenges requires effective action on many

fronts. Today, I would like to make four main points.

First, Microsoft is committed to continuing to strengthen our

software to make it less vulnerable to attack. Microsoft under its

Trustworthy Computing Initiative is working to create software for

its customers to secure by design, secure by default, and secure in

deployment. We are designing and writing software more securely,

making it more secure out of the box and making it easier to keep

secure.

These goals are becoming ingrained in our culture and are part

of the way we value our work. Even so, there is no such thing as

completely secure software. Therefore, and second, when security

vulnerabilities are found, the process is to provide customers with

the necessary fixes; they must be easy, fast and transparent so the

customers can stay secure in deployment.

For example, we have included an automatic update feature in

recent Microsoft operating systems. My written testimony describes

the additional steps we are taking in more detail. Our goal is to

make patch application easier so that every single customer can

readily have the appropriate patches installed and have his and

her information protected.

Third, as the recent past so amply demonstrates, criminals will

use computer networks to launch attacks, and we must be able to

respond quickly and effectively. In the case of Blaster, before the

worm was released, Microsoft built, tested, and delivered a remedy

for the vulnerability which Blaster exploited. We then undertook

extensive measures to advise customers of the need to apply the

patch immediately and how to protect their systems.

141

After the release of the worm, our efforts continued and expanded and included launching our Protect Your PC campaign,

which included providing security information to users through

publications such as the New York Times and the Washington

Post.

In parallel with these public efforts, we undertook an in-depth

review postmortem to understand how to reduce the likelihood of

similar vulnerabilities occurring in the future. We carried out a full

scrub of the subsystem that contained the vulnerability. And today

we are releasing an additional patch fixing vulnerabilities we

found. We know that security is a process of continuing improvement, and we are committed to that process.

Fourth, as a society, we need to devote increased resources to law

enforcement personnel, training, equipment, and capabilities to

prevent and investigate cyber crime. Technical and management

solutions cannot prevent every cyber attack. Determined and sophisticated cyber criminals develop new means to break into systems and harm the on-line public.

In this case, Microsoft worked closely with law enforcement efforts to identify the individuals or organizations involved, and created and released Blaster interference.

But despite the best and laudable efforts of the United States

and international law enforcement communities, it is still very

hard to identify and prosecute cyber criminals worldwide. For example, the computer forensic challenges facing law enforcement are

daunting. The amount of data that is stored electronically is growing exponentially, and law enforcement’s technical capability to extract critical evidence from this massive electronic data is falling

rapidly behind.

In conclusion, the Blaster worm and its variants were serious

criminal attacks against the owners and users of computer networks. These attacks merited and received equally serious attention from Microsoft, the government, our customers, and our partners. In the end, a shared commitment to reducing cyber security

risk and a coordinated public and private response to cyber security threats of all kinds offers the greatest hope for promoting security and fostering the growth of a vibrant, trustworthy on-line

world.

Thank you.

Mr. PUTNAM. Thank you very much.

[The prepared statement of Mr. Reitinger follows:]

142

143

144

145

146

147

148

149

150

151

152

153

154

Mr. PUTNAM. Our next witness is Vincent Gullotto. Mr. Gullotto

is the vice president of research for AVERT, the Antivirus Emergency Response Team, the antivirus research arm at Network Associates. For roughly half a decade, Mr. Gullotto has been involved

in the day-to-day operations of AVERT labs. Located throughout 18

cities around the world, AVERT labs is responsible for the research

and discovery of computer viruses, including Melissa, Love Letter,

and Bubble Boy. Are you the ones who name them?

Mr. GULLOTTO. Yes.

Mr. PUTNAM. So Bubble Boy was your idea?

Mr. GULLOTTO. Yes.

Mr. PUTNAM. Under his leadership, the AVERT group is credited

with the discovery of the first wireless virus, Phage.

Mr. Gullotto has developed the concepts and initial designs for

a number of AVERT service and solution offerings, including programs such as WebImmune, the world’s first Internet virus security scanner that resides on the Web, as well as the AVERT

Malware Stinger, a stand-alone program designed to supplement

antivirus programs.

Mr. Gullotto, we are looking forward your testimony and delighted to have you here.

Mr. GULLOTTO. Chairman Putnam, Ranking Member Clay, thank

you very much for inviting me today to join the subcommittee and

speak on behalf of a very serious problem we are having today,

computer viruses and the evolving threat that we see going forward.

As you stated, AVERT is an antivirus research arm for Network

Associates. We are a global organization working 24 hours a day,

7 days a week, discovering new viruses and naming new viruses as

well. In addition to this work, we also work participatingly with 27

other companies in the antivirus discussion network [AVED], and

on a day-to-day basis work closely with law enforcement as often

as possible to identify and investigate cyber attacks and cyber

crime.

While my written testimony submitted for the record provides a

recent history of computer viruses and worms, as well as descriptions and impacts of the most well-known ones, I want to focus my

testimony on three important trends and followup with three recommendations.

First, Mr. Chairman, governments and companies have become

more porous. In recent years, companies have opened their enterprise to serve customers better and improve productivity of employees and suppliers. Enterprises are becoming electronic sponges.

They are porous, and it’s getting harder to tell the inside from the

outside.

Second, reported vulnerabilities are on the rise. We have already

heard the number is on the increase, and they will continue to increase as time goes on. The bad news is that this new threat,

worms which exploit these vulnerabilities, can cause even greater

damage than more traditional worms and viruses.

And third, the speed of cyber attacks has accelerated dramatically with a shrinking window of exposure between vulnerability

and exploit. Attackers exploit a window of exposure between when

the vulnerability is announced and when all the infected systems

155

can be patched. Today, the time is short. It’s a matter of hours in

some cases or a matter of weeks and days. In the future we expect

it to become even shorter.

Once a vulnerability is announced, we may see an exploit within

a matter of hours, and that vulnerability exploited in such a way

that, within minutes perhaps, that exploit will be around the

world. Denial of services like CodeRed and Nimda caused spread

around the world in hours. And, of course, earlier this year we saw

Slammer infect thousands of machines in just under 3 minutes.

How do we protect ourselves from computer viruses, worms, and

other attacks? One key way is by moving from a traditional reactive approach to a security approach where proactive intrusive protection is used. What’s required to close the window of exposure is

protection in depth, including solutions that can be deployed before

a new threat appears in the field, so that the threat simply bounces

off the company’s defenses.

Intrusion prevention looks for anomalies, and attack signatures

in response, by preventing the attacks from permeating the network or system defense. An intrusion prevention system protects a

network from attack while providing breathing room and response

time for analysts to fix vulnerabilities.

There are other steps we can take to make a real difference.

While my written testimony has recommendations for enterprising

consumers, for the sake of time, I would like to share three with

the policymakers today.

First, we believe policymakers should embrace Cyber First Responders. We respectfully suggest the cyber security industry, including those at the table here today, represent Cyber First Responders in our battle against the attacks on the information infrastructure. Policymakers, in addressing the threat of viruses,

worms, and other attacks, should turn to these Cyber First Responders, who can provide policymakers with real-time, non-hype,

accurate information about the nature of threats and the extent of

the impact.

Second, policymakers should continue promoting a culture of security, a term used both in the United States and abroad, and here

today as well. We believe the policymakers around the world can

embrace this concept by continuing to shine a light on cyber security. Policymakers can support public awareness efforts such as the

Stay Safe Online campaign; the government industry’s collaborative bodies, including the Partnership for Critical Infrastructure

Security; focus government leadership, such as the government’s

high-ranking single point of command that we hope will be announced soon; and real-time information sharing organizations, including the various vertical sector information sharing and analysis

centers.

And finally, policymakers should increase support of long-term

cyber security research and development.

In addressing our cyber-security challenges, research and development plays a key role in allowing us to stay ahead of the next

generation of attacks. Yet many experts in industry and academia

agree that we are at risk of dropping the ball on critical R&D

needs.

156

In the area of R&D, we recommend that policymakers authorize

the study of our Nation’s critical infrastructure vulnerabilities, increase R&D funds to leading departments and agencies for collaborative R&D with industry and academia, refocus collaborative R&D

on longer-term challenges and improve coordination amongst government-funded R&D projects.

As we commonly know in the industry, security is not a place to

get to; it is an ever-evolving challenge. We urge the subcommittee

and Congress to continue to put energy into addressing the cybersecurity challenge, and in return, I pledge to you our company’s

commitment to work with government and industry and academia

to develop solutions to these urgent needs.

I thank you for the opportunity to testify this morning and look

forward to your questions.

Mr. PUTNAM. Thank you very much.

[The prepared statement of Mr. Gullotto follows:]

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

Mr. PUTNAM. Our next witness is John Schwarz. Mr. Schwarz is

president and chief operating officer of Symantec, responsible for

Symantec’s product development, incident response, sales, support,

professional services, marketing and partner relationships.

Previously, Mr. Schwarz was president and CEO of Reciprocal,

Inc., which provided comprehensive business-to-business secure ecommerce services for digital content distribution over the Internet.

Prior to taking the lead role at Reciprocal, Mr. Schwarz spent 25

years at IBM. Most recently, he was general manager of IBM’s Industry Solutions Unit, a worldwide organization focused on building business applications and related services for IBM’s large industry customers. He has held numerous development positions

within IBM, including vice president of development for the company’s Personal Software Products Division where he was responsible

for IBM’s OS/2 Warp and PCDOS product management systems development.

As the vice president of application development for the Software

Solutions Products Group in Toronto, he was responsible for the development of worldwide product management of IBM’s application

development and distributed data base products business.

We look forward to your testimony, Mr. Schwarz. Welcome to the

committee.

Mr. SCHWARZ. Chairman Putnam, Ranking Member Clay, thank

you for the opportunity to provide testimony on this important and

timely subject, and thanks for that long personal history.

Today, much of our economy depends on critical assets that are

in digital form. We are a society that relies more and more on information technology; yet, we have not taken the steps to protect

those assets to the same degree that we have our physical assets.

The cyber world is maturing and is a pervasive structure in organizations, as well as at home. It is also becoming more complex and

vulnerable. The attacks are faster, less predictable, and more severe. The number of opportunities for exploitation also continues to

grow at a rapid pace. In fact, it is estimated, on average, 250 new

software vulnerabilities are discovered each month. These

vulnerabilities are being exploited faster and more aggressively

than ever. Again, on average, the industry is identifying 450 new

viruses each month, with some very colorful names, with many

reaching pretty high severity levels.

We saw the transition to ‘‘blended threats,’’ with worms like

Code Red and Nimda containing multiple attack mechanisms.

These blended threats, that combine the attributes of a traditional

virus and a hack attack, typically resulting in a massive denial of

Internet services, are truly the biggest threat we face today in the

cyber world. Leveraging the vast number of new vulnerabilities,

and through the introduction of destructive payloads, rapidly propagating blended cyber attacks, represent a substantial future risk.

The next generation of attacks, known as ‘‘flash threats,’’ have

the potential to infect massive portions of corporate networks or

the entire Internet within minutes or perhaps even seconds. The

recent Blaster or SQL Slammer worms saw hints of these types of

threats. As you’ve already heard, SQL Slammer infected 90 percent

of the initially vulnerable systems in approximately 10 minutes.

173

Such threats require entirely new proactive systems to stop

them. There’s no reactive remedy that will ever be fast enough to

protect against threats spreading at these speeds.

The interconnectivity of individuals, businesses, and government

organizations is becoming ever more pervasive and continuous

through always-on broadband connections. As a result, there is a

vast, unmanaged computing capacity that is potentially available

to the cyber criminals to launch massive denial-of-service offensives

against selected targets or perhaps against the Internet as a whole.

Let me discuss some actions that we believe can improve our

cyber security. First, awareness and education often mentioned

today.

Educating our consumers, our businesses, the operators of critical infrastructure as well as all levels of government, on the importance of protecting our systems is essential. We need a broad

awareness campaign that reaches out to all users of the Internet.

At the least, all users need to be made aware of the value of firewall and automatically updated antivirus technology, like putting

seat belts in cars. The remote or wireless connected worker is becoming more prevalent and can unknowingly open up an otherwise

secure community network to potential vulnerabilities and attack

through unprotected wireless connections in the home or in the office.

At the enterprise and organization level, the issue of IT security

has for too long been left to the security administrator, or the CIO.

This needs to change. Cyber security needs the top leadership of

the business or government organization. As an example, the recent corporate governance legislation known as Sarbanes-Oxley significantly strengthened the rules pertaining to the financial management of all businesses. However, the legislation makes no mention of the importance of protecting the information systems that

produce the data used in the financial management processes. Only

when cyber security is treated with the same attention as the protection of physical and financial assets can we enable the necessary

cultural change and focus enough attention and resources to truly

address the cyber threat.

Second, cyber crime. We saw the arrest of Jeffrey Lee Parson for

writing a variant of the Blaster worm, but we have yet to find the

bigger culprits, the original authors of the recent flurry of new attacks. We need to realize that protecting the Internet is really a

global issue, one that requires better international cooperation. We

need more and higher quality resources for law enforcement to

work on computer forensics, and we need cooperation from government and industry to assist prosecutors in building cases.

We require more harmony in cyber crime laws. Perhaps the

Council of Europe’s cyber crime treaty is a good starting point.

Governments and industry should reach across borders when appropriate to share information on cyber crime cases, best practices,

threats and vulnerabilities, in order to gain a measure of prosecution success and early warning of potential attacks.

The industry information sharing and analysis centers, the

ISACs, can be a nucleus of that initiative. There should be a confidential, single point of contact in government so that the experts

can communicate at a peer level at times of major cyber attacks.

174

And again the recently announced cyber warning information network will be a good base for this exchange.

Third, research and development; as mentioned earlier flash

threats may be wreaking havoc in the near feature, and we must

be more productive in our cyber security practices, focusing on behavior blocking technologies, faster threat identifications to event

correlation, real-time vulnerability scanning, and automated software patch deployment.

Given the shrinking time from discovery to exploit, much new research and development needs to take place which even the combined resources of the industry cannot deliver in time. The government and academia must join this effort with incremental funding,

proactive recruiting of the best talent and highly focused, jointly

funded precompetitive projects.

Finally, audit and risk analysis: Security is not a static issue

and, thus, requires regular assessments of systems and vigilance

on the part of the IT managers, and for that matter, all users of

the Internet. I commend the committee for its efforts to enact programs like FISMA, which require annual assessments of government systems and also require actions to improve the protection of

those systems.

The committee’s oversight in this area is invaluable. This is not

just something that government should do, but all enterprises,

large and small, should be encouraged to follow this example of

regular security assessments. Critically, though, we need thorough

and timely remediation of any audit findings. The current performance of most organizations, government and industry alike, falls

well short of desired levels.

In closing, let me issue this challenge to the industry, government, and individual users. We must take cyber security more seriously and we must do it together. Aware and compliant users are

the best defense against most cyber attacks. Most importantly, we

all, as individual users of the Internet, need to do our part to protect cyberspace. Experience shows that effective implementations of

security solutions cost in the range of 6 to 8 percent of the overall

IT budgets. Few corporations or government departments have allocated adequate levels of funding to this critical need. It is time

that we put our resources to work to minimize the risk of a serious

disruption of our national cyber infrastructure.

Thank you and I look forward to your questions.

Mr. PUTNAM. Thank you very much, Mr. Schwarz.

[The prepared statement of Mr. Schwarz follows:]

175

176

177

178

179

Mr. PUTNAM. I appreciate the input of this entire panel, and for

the record, this was the worst panel about sticking to the time

lines. Usually it’s the bureaucrats that go over. But all of you were

very interesting with very important information, and we are delighted to have it. I would like to begin with Mr. Reitinger with

Microsoft.

You have had a bad month. It has been a tough several weeks

at the office. Walk us through what happens when someone,

whether they have altruistic intentions, or not-so-altruistic intentions, notifies you of a vulnerability.

And walk us through the process of developing a patch, releasing

it; and at what point do you notify the Federal Government, as well

as your customers? Could you just walk us through that process?

Mr. REITINGER. Of course, Mr. Chairman.

Ideally, the process works with, if there’s an external notification, someone contacting a software vendor, which might be Microsoft or another vendor, who then begins to develop a patch. If the

notification is to the vendor, that allows the vendor to work to develop the patch in advance so that the public can be protected.

The patch is developed, and that can be a very intensive process.

The Blaster patch or the patch for the vulnerability of the Blaster

attack, for example, was done due to a number of different operating systems. The information associated with it had to be developed, I think, in 25 languages. And then that patch is rolled out.

In the case of Microsoft, Microsoft rolls out patches unless there’s

a public exploit, generally on a Wednesday for predictability purposes, so customers can know it’s coming. At that point, we begin

to work actively with the community, with our customers, with people in the Federal Government, including the Department of Homeland Security, to make sure that the information about the patch

can get distributed as broadly as possible.

Now this next stage is the most critical stage because patch uptake, as we know, is critical. The vast majority of attacks that we

have seen over time have been after a patch is released. So the key

is getting patch uptake once the patch is released and available.

At some point in that process, as happened in the case at issue,

there may be some exploit code that is released and perhaps eventually there is a worm or another set of attacks that are involved.

But that is the big window, to get patch uptake as broad and as

deep as possible.

Mr. PUTNAM. Does the Federal Government or a particular agency of the Federal Government receive an early heads-up about a

vulnerability that could have serious consequences?

Mr. REITINGER. Typically, because Microsoft’s products are distributed so broadly, both within the United States and around the

world, the notification is done at the same time; in other words, we

released one, we released all. And the reason is, we’ve got customers around the world, we’ve got users around the world. You

need to make sure you can distribute the information as broadly

and as deeply as possible, and so it’s generally notification to many.

Mr. PUTNAM. So a vulnerability comes to light, you develop the

patch, you put it out there, and then it becomes the responsibility

of the consumer to actually patch their system. And in this most

recent case, despite the fact that your patch had been out there for

180

weeks, those who failed to download it had the system go down;

and so it reflects poorly despite the fact that you had already provided the solution.

My understanding is, Microsoft is working on some better technology to make those downloads automatic. And are there legal

issues, specifically the Computer Fraud and Abuse Act, that might

prevent you from making it easier for consumers to patch their systems?

Mr. REITINGER. As the chairman’s question indicates, there is already a future in Microsoft operating systems called Auto-Update

that can automatically download and prompt the user to install

patches. We are currently looking at how we can make that process

easier and transparent for end-users so they can more readily have

that option available to them, so that more people will in fact use

and install Auto-Update.

I think your question about the Computer Fraud and Abuse Act

goes to the question of whether we could basically say to our customers, you have to use Auto-Update and we install Auto-Update

by default. And the answer to that question is, yes, there are legal

problems. Laws like the Computer Fraud and Abuse Act and other

regulations, European directives, would prohibit access to an enduser’s computer without an access of authority.

We actually need consent to do that, and that is something we

want to do. We want to, in fact, not overcome consumers’ consent,

but empower them and make their consent more effective and

make it more able to control their own computer security and privacy.

Mr. PUTNAM. Mr. Akers, what’s your take on the whole process

of notification? And walk us through your system, if it differs from

Microsoft, when you have an issue that may arise that may impact

the Federal Government.

Mr. AKERS. It does differ a little bit.

We have been at this process since I have been at the company,

and most notably our last restart of the process was in 1997, so it’s

a continuous process that we undertake. Our intent from the discovery of vulnerability, either internally or externally found, is notification to the customer and remediation so that the customer is

not impacted. You also have to remember that in the case of Cisco,

the fabric of the Internet itself and the intranets that deploy these

patches is, in and of itself, part of the issue we have to consider

as a part of the problem, too.

So, for instance, we have to be worried about our ability to distribute patches if the fabric itself does not have integrity. So when

we discover vulnerability, we also begin to develop a patch. But we

also, at the same time, begin to develop a plan of notification and

remediation. These take different shapes depending on the nature

of the vulnerability, the technologies that are involved and the

issues that are at hand. In some cases, because we have to ensure

that we can deploy the released information and the software itself,

we may notify critical infrastructure components of the problem so

that they can remediate the problem, so we can continue then to

work with the rest of the constituent customer base to deploy software release and information.

181

We look at this on an individual case basis and use processes and

policies within the company to determine how to do that, at which

time we then go through the process of completing the software

build, much as Microsoft indicated they do. Once that is ready,

both the plan and the software, we then begin the notification process and remediation process with our customers.

We believe this process, for us, has worked well over the years

and believe that it provides the best of both worlds in the context

of both protecting the infrastructures themselves, our customers,

and making sure that we get the information into the hands of the

people that can protect themselves before the information is made

available to those that might exploit it and use it for detrimental

purposes.

Mr. PUTNAM. Do you have a different notification process for an

agency of the Federal Government than you do for an individual

customer?

Mr. AKERS. We treat the agency of the Federal Government as

if it were part of the critical infrastructure, and we put them in the

same structure prioritization as we would any other critical infrastructure. If we determine that a critical infrastructure asset of the

Federal Government has a particular or unique circumstance, they

would be prioritized accordingly within our scheme.

Mr. PUTNAM. Mr. Reitinger, in the cyber hacker world, everybody

likes to pick on Microsoft. As we heard in earlier testimony, everybody gets their merit badges by messing with you all.

You have a tremendous background in law enforcement, as well,

so you have seen both sides of this. Are you satisfied with the legal

framework that exists today for punishing people who are hackers?

Mr. REITINGER. That is a very good question, Mr. Chairman. I

think, in terms of punishing hackers, the answer is mostly yes, because Congress just last year passed an additional law raising the

penalties for cyber crime and how that’s going to work in practice,

the sentencing guidelines associated that are now being developed.

There are two other areas, though, that require examination.

One is, is the breadth of penalties enough? Have we criminalized

everything we ought to criminalize as opposed to what the amount

of the penalty is? And I think that can change over time as new

ways to harm people on-line are created.

Secondarily, there is the question of law enforcement’s ability to

identify and then prosecute people, and that is the point to which

my testimony related. It is actually very hard to—as your questions

to Mr. Malcolm on the first panel indicated, it is very hard to identify hackers and virus writers and worm writers online, and we

need to do what we can to remediate that. And perhaps the biggest

way to do that is to ensure that law enforcement has the resources

necessary to attack the problem, particularly with regard to training and things like forensics capabilities.

The last element I’ll just mention briefly is the international

piece. As Mr. Schwarz indicated, it’s critical. All cybercrime—not

all cybercrime, but almost all cybercrime involves an international

element. Even if it’s a person in the United States attacking a

place in the United States, they will probably pass their attacks

abroad. So you typically have an international element in

cybercrime. That means that you have to have the same capabiliVerDate 11-MAY-2000 11:30 May 04, 2004 Jkt 000000 PO 00000 Frm 00185 Fmt 6633 Sfmt 6633 D:\DOCS\92654.TXT HGOVREF1 PsN: HGOVREF1
182

ties that you have in the United States created around the world,

and things like the Council of Europe Cybercrime Convention, if

ratified by countries like the United States and other signatories,

could go a long way toward remediating that problem.

Mr. PUTNAM. Mr. Gulloto and Mr. Schwarz, your company’s mission in life is to protect your clients’ systems from these worms,

from these viruses, from these hackers, from malicious code. You

monitor this on a 24-hour, 7-day-a-week basis. Do you notice any

trends in where these threats come from? Is there a seasonality to

the trends? Are there more in the summer than there are during

the school year? Do they arise from Eastern Europe or Asia or

North America? Could you give us some sense of the landscape of

the threat environment?

Mr. SCHWARZ. Let me jump in and obviously allow my colleague

to comment. We today monitor almost 1,000 customers’ networks

around the world and have further some 22,000 real-time scanners

placed in strategic points around the Internet around the world.

That level of input gives us a pretty good perspective on what is

actually happening on the Internet.

First and foremost, the majority of the attacks appear to be originating in the United States, so the thought of somehow being flooded from the outside does not seem to hold true.

Second, the attacks are gaining in, if you will, virility as a result

of shared technology, which is very much available in public domains on the Internet. So one of the comments I would make relative to the criminalization of this conduct, ought to think about

including the publishing of exploitation methodologies and tools

which can then be downloaded by people who don’t necessarily

have the skill to further the damage of the Internet.

We do not see any seasonality, we do not see any changes in

scope as the year progresses or as various political events happen

to take place around the world. What we do see is a direct correlation between the rise of always-on broadband connection and the

penetration of these attacks around the world as these always-on

machines are taken over and used as a base to launch massive further damage. And as my colleague from Microsoft points out, the

tracing of these attacks to its origin, given today’s technology, is almost impossible.

Mr. PUTNAM. Mr. Gulloto.

Mr. GULLOTO. I concur with a great deal of what Mr. Schwarz

said. What I would like to address is a little bit more about the

specifics of the origins of the virus-writing activity itself, specifically where viruses may or may not come from. In many cases, as

we’ve heard previously today, and today and I will concur with that

as well, it is very difficult for us to specifically state where a virus

has been written or where it is originating from. As Mr. Schwarz

has pointed out, there is—a majority of the traffic originates in the

United States, but we are not completely convinced that the traffic

that originates in the United States actually came from the United

States.

I’ll go to an example of a group called 29 A that exists, from what

we understand and what we have researched, in Brazil and in

Spain. There is a common language between the two. We have seen

even in code where one virus writer will acknowledge another virus

183

writer for helping create some piece of code together or in such a

way in which they were successfully able to take one piece of expertise from one area and the other from another area, get it to work

together, and then in many cases it will get out. Now, it gets out

deliberately in some cases, or they may post it to a Web site which

will ask people to come to that Web site, get that—it could have

come from the United States—double-clicked it when they put it on

their desktop or began to simply distribute it throughout a network

of friends, who then may have double-clicked on it to get it moving

in the case of a mass mailer.

The worms are a little more difficult to state, meaning that I

may be a virus writer that lives in Belgium—which there is a

woman virus writer, her name is Gigabyte, she is 18 years old. She

may have written a piece of code at her home in Belgium, but she

may have taken it to France, went into an Internet cafe, put in her

floppy disk, go to the program, ran it. That program immediately

begins to spread. She unplugs the diskette, pays her 5 euro for the

hour that she spent on the computer, and she walks out the door.

It begins to spread at that particular point in time.

Mr. PUTNAM. Mr. Schwarz, you mentioned that the majority of

the attacks originate in the United States. Do you distinguish between probes and attacks, or are they the same term?

Mr. SCHWARZ. We do distinguish among various categories and

severities of attacks. And, yes, there are distinctions between

probes where people are looking for vulnerabilities or open switches, if you will, open access points, and actual attacks that have

been launched to penetrate and cause damage. We see about 175

million such events per day across the spectrum of the systems

that we do monitor. Categorizing that volume of data to actually

identify specific types of attacks is a bit of a daunting task. What

we do with the data is correlate the information from multiple

points and attempt to isolate those that have potential for being serious or those that indicate a new type of activity from which we

have not been able to defend ourselves previously, and then build

defenses based on that new intelligence.

Mr. PUTNAM. And do those probes also mostly originate from the

United States?

Mr. SCHWARZ. The total traffic that we see—and again, I agree

with Vincent’s point relative to the actual pinpointing of the origin

of the code, but the total traffic volume still is to some 75 or 80

percent originating in the United States. What we see is countries

that have a very large prevalence of always on connections, like

Korea and Japan, ranking very high, perhaps beyond the size of

their population, but that may be simply spoofed addresses targeting those countries as a way to launch attacks, but not originating

there.

Mr. PUTNAM. One of the concerns that we have heard, particularly with the reference to the virus that went silent today, was

shut down as of today, is that it is an attempt by these code writers

to learn, to explore the system for a finite period of time, and then

before it could necessarily be reacted to, it goes down so that they

are learning and essentially applying that knowledge toward developing the better or the perfect virus or the perfect worm. Could you

comment on that? Anyone.

184

Mr. GULLOTO. I would agree that is certainly a possibility. We

have seen behavior like this for quite some time. Approximately 3

years ago Mr. Hale, who had testified a little bit earlier, and I were

on a committee, if you will, that looked at a threat called Leaves.

It was an Internet worm. And at first it had looked to be rather

a meek worm, but as we did more and more analysis of it, it became very complex in what it was that it did. It looked to be something that perhaps someone had created to see what would happen

if they released it, what data could it gather, where could it go,

what could it do so that they could then in turn go ahead and create another threat of such a nature to then have it go further. The

good news was that person was actually arrested. And so I don’t

have any idea what happened to that person, but I know that there

was an arrest in that case.

Now, we could take a look at other such threats and also concur

that there is some education process. We could look at one specific

factor in a threat to say this might be what they are looking to see

works or doesn’t work. The SoBig virus now is one that you mentioned, is one that’s in its fifth to sixth generation, meaning it is

multiple family members. There have been other variance of SoBig

that have spread quite far as well, and the commonality amongst

each variant is that it has an extension, which is PIF. And in many

cases, when we see a new extension be exploited, it is an opportunity for all virus writers to learn to see if it will become successful or not, because if it is successful, others will use that same extension, knowing fair well that most computer users, which we

would probably look to more toward the consumer user, but then

again end users, within an environment would not understand.

We’ve spent a great deal of time educating people in the past

couple of years about how not to click on anything that has a VBS

extension. Well, we got them to understand that. Those viruses

seem to have gone away. However, PIF looks a lot like JIF. JIF is

not necessarily a file that can be infected. People double-click on

it every single day and e-mail. No problems. They get to see something, it’s great. It’s a misunderstanding. Virus writers probably

understand this, use it to educate themselves to see what else they

can plant that will become successful.

Mr. PUTNAM. Mr. Schwarz, did you wish to add anything to that?

Mr. SCHWARZ. I think this is a very accurate description of the

actual state of the technology used by the virus writers. Again, I

would like to stress the importance of dealing with Web sites that

actually publish this information, which are then shared among a

community of people that perhaps do not have the skill to create

the original varieties, but can adapt and cause additional damage.

One other thought which I would like to leave with the panel or

with the committee is that many of the worms that perhaps or the

viruses that are perhaps the most threatening are not those that

achieve the notoriety of a SoBig. They are very visible because of

the traffic they generate, but perhaps a low-profile-type worm or

Trojans that have been placed in strategic points in the network

in systems that are very critical to a business or the national infrastructure that can be triggered somewhere down the road with a

subsequent worm or subsequent attack, causing a disruption of

service or causing deletion of data, or causing, in fact, just a flow

185

of information to an entity that might wish to observe what is

going on.

So we need to not observe just those attacks that cause the service very large volume issues, but need to be looking for low-profile,

potentially, in fact, more insidious and dangerous worms than

those we have seen to date.

Mr. PUTNAM. Mr. Akers and Mr. Reitinger, recognizing that

there will never be a perfect code, what can software designers do

to develop more secure codes, more secure systems as the abilities

of the bad guys, the black hats, continue to improve? What efforts

can we take to get better, more secure systems?

Mr. AKERS. I think there is actually two things that we are both

doing, and we need to continue to do, as an industry. Education is

a big part with our software developers. We teach our software developers that are coming out of academia today to develop software

based on the function required at hand, and we don’t teach them

to be mindful of the issues around security that might provide

vulnerabilities and subsequent exploits.

There are a number of programs out there. There are centers of

excellence that are part of a program at the National Security

Agency. There are a number of other venues by which we acquire

information about how to do good quality, secure software engineering. And we need to continue to educate our software engineers

and academia how to do those things and for those that are out in

practice today, and continue to do what we are doing, which is

bringing that information directly to them so that as they develop

a product initially, they are mindful of the issues that we are dealing with from a security standpoint today. This is something that’s

going to be an ongoing process.

The second thing is continued testing. And that is something

that I know that most of the vendors here and most of the vendors

across the community are doing more today than we ever have. We

internally have programs, we externally have programs, and we

are going to continue to reinforce our ability to simply look for and

test for those vulnerabilities that we might be in a position to uncover that we can then mitigate prior to the time of an exploit.

I want to kind of piggyback on the last question a little bit, too.

As we look at this issue around vulnerability yielding an exploit,

the other thing we can do is we could watch the testing of some

of this exploit code. I can’t think of a vulnerability that has been

disclosed that at some point along the line somebody didn’t turn

the knob to see if it was more interesting than maybe the vulnerability seemed at the time the vendor talked about it. And if we

start seeing these kinds of things, government and private sector

should be able to identify those instances and come together to

take a look at what the miscreants might actually be doing, and

then start thinking about how to thwart the attempts that they

may make at those particular vulnerabilities going forward.

Mr. PUTNAM. You mentioned the education and then its importance for your software designers. But these miscreants, as you’ve

referred to them, or script kiddies are more intellectually driven;

it is a game. Some people do crosswords, some people try to break

into systems, and then the more malicious types. Now, don’t script

kiddies grow up to work for the Microsofts and Ciscos of the world?

186

Mr. AKERS. Not knowingly, in my case. We take a very dim view

of that activity. But, no. Typically it’s difficult to even distinguish

between the activities of the script kiddies and the more orchestrated and well-organized, funded, and otherwise notable engagements. As a matter of fact, understand that it wouldn’t be out of

the realm of possibility that those more well-developed organizations and entities could take advantage of the behavior of the script

kiddies to accomplish what they want to accomplish. So education

of software engineers is a key part of it. And what you generally

find, or at least what we generally find, is they do have a—once

educated, they do maintain and have a clear understanding of the

issues and want to do the right thing.

I think as was said earlier, it’s almost viewed as being patriotic

to make sure that when we’re providing critical infrastructures,

we’re doing it with the highest degree of quality and security that

we possibly can. And our developers take that to heart much like

the rest of the developers in the community do.

Mr. PUTNAM. Mr. Reitinger.

Mr. REITINGER. Mr. Chairman, let me answer that question in

two parts, first what software companies can do, and then turn to

the education points.

What software companies can do is have a robust software assurance process. Conduct code reviews before software ships, use independent test teams, do threat modeling, make sure they train their

developers. Use automated tools to test for security, and seek thirdparty certifications such as the common criteria. This is something

that companies like Microsoft and other software companies do.

They need to conduct robust after-actions when vulnerabilities do

occur to figure out what went wrong and how the process can be

fixed going forward, because security is really a destination as opposed to an end. Or, excuse me, is really a process as opposed to

an end.

Software companies need to make security easier to do so that

the software’s secure out of the box and it’s easier to maintain

going forward. So there’s a whole software assurance and software

support process that can ease the burden and help solve the problem.

With regard to education, there are a number of components of

that. One is educating users about how they can secure their systems. That is the focus of a lot of government efforts and the Microsoft Protect Your PC Initiative.

There is also the component of the ethical outreach to kids,

which was the subject of your present talk. How do we stop—how

do we make young folks, if you will, not do the sorts of things that

some of them are doing now, attacking systems, so that we have

less chaff that we have to worry about to find the wheat. That is

a really hard problem, and I think requires us to figure out how

to convince young, computer-literate people that breaking into systems, if you will pardon the colloquialism, isn’t cool. It doesn’t build

your status in a peer group. It’s like burning down a building. And

people really get hurt. That’s something we have not all successfully done yet, and we need to continue to work on.

Mr. PUTNAM. Mr. Schwarz, Mr. Gulloto, do you all have any comments on either of those issues? Do you have any comments on the

187

education component, and how we can be more effective at it, and

whose responsibility it is?

Mr. SCHWARZ. Let me offer one suggestion. Obviously, education

is hugely important, and the more we do, the better for all of us.

There is a technology solution that can be applied to partly address

this problem, which is something that we call client compliance, or

compliancee, as it is called in bad English. Client compliance is

about ensuring that when a client is reaching out to the network

to be connected, that the network has the ability to test whether

that client meets some basic minimum standards of good housekeeping relative to security.

It would be great if we could come together, government and industry, and develop a joint standard for how that compliance could

be achieved and then have the ability for the ISPs, for the in-house

servers, to, in fact, test every client before they are given access to

the network. That technology in addition to education could help us

dramatically improve the level of standard, the level of security

that we see today.

Mr. PUTNAM. Mr. Gulloto, any comments?

Mr. GULLOTO. With regard to the education aspect, today we face

a point where we are about to probably look at the next generation

of threats and how is it that we can educate primarily the home

user, but to protect themselves from those threats. We have them

to the point that they understand that they are probably best

served by putting antivirus and updating that antivirus as often as

a vendor makes it available.

Antivirus today is no longer sufficient enough to protect everyone

from the threats that we are seeing such as the Internet worms,

which in many cases travel at certain points in the Internet where

there may not be an antivirus product that can actually support or

protect them from that. Therefore, as we have spoken about today,

the evolution of the threat, we have to evolve our education and

how we go about having the consumer at home understand that the

Internet is a big city, and that like many cities, there are good

parts and there are bad parts. You should proceed with caution in

both areas, and understand that what you may find in the good

part is good; what you may find in the bad part might look good,

but it’s not necessarily good.

People that are using the Internet today to exploit children, they

are looking to exploit consumers by stealing data for a financial

gain, I think are slightly different than perhaps some of the script

kiddies that we have spoken about today. But clearly, when we developed the stay safe on line campaign sometime back, I think we

looked to find that to be an avenue in which we could teach the

consumer ways in which we could have them understand as to

what a bad guy looked like on the Internet and what a good guy

looked like on the Internet, and perhaps what a bad guy that

looked like a good guy on the Internet was.

I think funding plays a huge part of it, actually, to be able to

maintain and sustain this type of education, this evolving education that we need, which is why many of us today have talked

about ways in which we can find funding to further R&D, but that

R&D will include education.

Mr. PUTNAM. Thank you very much.

188

I am told that there is a 1:30 hearing in this same room, and so

we need to bring it in for a landing. Is there anything that we have

not covered that any of the panelists would like to add to the discussion before we wrap up? Beginning with Mr. Akers. Do you have

any final comments?

Mr. AKERS. No.

Mr. PUTNAM. Mr. Reitinger.

Mr. REITINGER. Thank you for the opportunity to testify today,

Mr. Chairman.

Mr. PUTNAM. Delighted to have you. Thank you. Appreciate your

insight.

Mr. Gulloto.

Mr. GUTKNECHT. No. Thank you.

Mr. PUTNAM. Dr. Schwarz.

Mr. SCHWARZ. No. Thank you.

Mr. PUTNAM. Well, thank you all very much. This has been an

outstanding hearing. I do apologize for its length, but I think that

it was valuable and well worth our time.

I will remind everyone we have two more hearings next week on

cybersecurity as well. And, with that, the record will remain open

for 2 weeks for submitted questions and answers of topics that we

were unable to get to today.

The subcommittee stands adjourned.

[Whereupon, at 1:20 p.m., the subcommittee was adjourned.]

Æ